CVE-2019-7345

Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the view ...

4.8 MediumFix available

CVE-2019-7345 is a medium vulnerability (CVSS 4.8) in Zoneminder, published February 4, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.67%, the 52nd percentile. Fixed in zoneminder 1.36.7-r0.

Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the view 'options' (options.php) does no input validation for the WEB_TITLE, HOME_URL, HOME_CONTENT, or WEB_CONSOLE_BANNER value, allowing an attacker to execute HTML or JavaScript code. This relates to functions.php.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

0.67%Up 0.2 points since Apr 14, 2021

What each source reports

NVD Score used 4.8

Record: CVE-2019-7345
CVSS 3.0: 4.8 MediumCVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0: 3.5 LowAV:N/AC:M/Au:S/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Record: CVE-2019-7345
Updated: 2026-11-02

EUVDEUVD-2019-16888 No score

Record: EUVD-2019-16888
Updated: 2026-11-03

GitHub AdvisoriesGHSA-qch8-8p57-v3gr 4.8

Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the view ...

Record: GHSA-qch8-8p57-v3gr
CVSS 3.0: 4.8 MediumCVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSVALPINE-CVE-2019-7345 4.8

Record: ALPINE-CVE-2019-7345
CVSS 3.0: 4.8 MediumCVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-03

OSV 4.8

Record: CVE-2019-7345
CVSS 3.0: 4.8 MediumCVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2019-7345 4.8

Record: DEBIAN-CVE-2019-7345
CVSS 3.0: 4.8 MediumCVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2019-7345 4.8

Record: UBUNTU-CVE-2019-7345
CVSS 3.0: 4.8 MediumCVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

Affected products

zoneminder

Affected packages

Affected packages
Package	Affected	Fixed
`zoneminder` Alpine:v3.15	before 1.36.7-r0	1.36.7-r0
`zoneminder` Alpine:v3.16	before 1.36.7-r0	1.36.7-r0
`zoneminder` Alpine:v3.17	before 1.36.7-r0	1.36.7-r0
`zoneminder` Alpine:v3.18	before 1.36.7-r0	1.36.7-r0
`zoneminder` Alpine:v3.19	before 1.36.7-r0	1.36.7-r0
`zoneminder` Alpine:v3.20	before 1.36.7-r0	1.36.7-r0
`zoneminder` Alpine:v3.21	before 1.36.7-r0	1.36.7-r0
`zoneminder` Alpine:v3.22	before 1.36.7-r0	1.36.7-r0
`zoneminder` Alpine:v3.23	before 1.36.7-r0	1.36.7-r0
`zoneminder` Alpine:v3.24	before 1.36.7-r0	1.36.7-r0

Show 10 moreShow less

Affected packages
Package	Affected	Fixed
`zoneminder` Debian:12	before 1.34.6-1	1.34.6-1
`zoneminder` Debian:13	before 1.34.6-1	1.34.6-1
`zoneminder` Debian:14	before 1.34.6-1	1.34.6-1
`zoneminder` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 1.28.1-81.29.0+dfsg-11.29.0+dfsg-1ubuntu11.29.0+dfsg-1ubuntu21.29.0+dfsg-1ubuntu2+esm1	None known
`zoneminder` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 1.32.3-2build11.32.3-2ubuntu11.32.3-2ubuntu21.32.3-2ubuntu2+esm1	None known
`zoneminder` Ubuntu:Pro:22.04:LTS	All versions, plus listed versions 1.36.7+dfsg1-11.36.10+dfsg1-11.36.11+dfsg1-11.36.12+dfsg1-11.36.12+dfsg1-1ubuntu0.1~esm1	None known
`zoneminder` Ubuntu:24.04:LTS	All versions, plus listed versions 1.36.33+dfsg1-1build11.36.33+dfsg1-1build21.36.33+dfsg1-1build31.36.33+dfsg1-1build4	None known
`zoneminder` Ubuntu:25.10	All versions, plus listed versions 1.36.35+dfsg1-1	None known
`zoneminder` Ubuntu:26.10	All versions, plus listed versions 1.36.37+dfsg1-1	None known
`zoneminder` Ubuntu:26.04:LTS	All versions, plus listed versions 1.36.35+dfsg1-11.36.37+dfsg1-1	None known

History

History
When	Changed	Sources
2026-11-03	affected, aliases, references	OSV
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV