CVE-2019-7343

Reflected - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker...

6.1 MediumFix available

CVE-2019-7343 is a medium vulnerability (CVSS 6.1) in Zoneminder, published February 4, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.87%, the 58th percentile. Fixed in zoneminder 1.36.7-r0.

Reflected - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'newMonitor[Method]' parameter value in the view monitor (monitor.php) because proper filtration is omitted.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

0.87%Up 0.5 points since Apr 14, 2021

What each source reports

NVD Score used 6.1

Record: CVE-2019-7343
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Record: CVE-2019-7343
Updated: 2026-11-02

EUVDEUVD-2019-16886 No score

Record: EUVD-2019-16886
Updated: 2026-11-03

GitHub AdvisoriesGHSA-h223-6wf3-rpv4 6.1

Reflected - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker...

Record: GHSA-h223-6wf3-rpv4
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSVALPINE-CVE-2019-7343 6.1

Record: ALPINE-CVE-2019-7343
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-03

OSV 6.1

Record: CVE-2019-7343
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2019-7343 6.1

Record: DEBIAN-CVE-2019-7343
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2019-7343 6.1

Record: UBUNTU-CVE-2019-7343
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

Affected products

zoneminder

Affected packages

Affected packages
Package	Affected	Fixed
`zoneminder` Alpine:v3.15	before 1.36.7-r0	1.36.7-r0
`zoneminder` Alpine:v3.16	before 1.36.7-r0	1.36.7-r0
`zoneminder` Alpine:v3.17	before 1.36.7-r0	1.36.7-r0
`zoneminder` Alpine:v3.18	before 1.36.7-r0	1.36.7-r0
`zoneminder` Alpine:v3.19	before 1.36.7-r0	1.36.7-r0
`zoneminder` Alpine:v3.20	before 1.36.7-r0	1.36.7-r0
`zoneminder` Alpine:v3.21	before 1.36.7-r0	1.36.7-r0
`zoneminder` Alpine:v3.22	before 1.36.7-r0	1.36.7-r0
`zoneminder` Alpine:v3.23	before 1.36.7-r0	1.36.7-r0
`zoneminder` Alpine:v3.24	before 1.36.7-r0	1.36.7-r0

Show 9 moreShow less

Affected packages
Package	Affected	Fixed
`zoneminder` Debian:12	before 1.34.6-1	1.34.6-1
`zoneminder` Debian:13	before 1.34.6-1	1.34.6-1
`zoneminder` Debian:14	before 1.34.6-1	1.34.6-1
`zoneminder` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 1.32.3-2build11.32.3-2ubuntu11.32.3-2ubuntu21.32.3-2ubuntu2+esm1	None known
`zoneminder` Ubuntu:Pro:22.04:LTS	All versions, plus listed versions 1.36.7+dfsg1-11.36.10+dfsg1-11.36.11+dfsg1-11.36.12+dfsg1-11.36.12+dfsg1-1ubuntu0.1~esm1	None known
`zoneminder` Ubuntu:24.04:LTS	All versions, plus listed versions 1.36.33+dfsg1-1build11.36.33+dfsg1-1build21.36.33+dfsg1-1build31.36.33+dfsg1-1build4	None known
`zoneminder` Ubuntu:25.10	All versions, plus listed versions 1.36.35+dfsg1-1	None known
`zoneminder` Ubuntu:26.10	All versions, plus listed versions 1.36.37+dfsg1-1	None known
`zoneminder` Ubuntu:26.04:LTS	All versions, plus listed versions 1.36.35+dfsg1-11.36.37+dfsg1-1	None known

History

History
When	Changed	Sources
2026-11-03	affected, aliases, references	OSV
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV