CVE-2020-25730: Zoneminder

High severity, CVSS 8.2. EPSS: 0.6% chance of exploitation in the next 30 days.

Cross Site Scripting (XSS) vulnerability in ZoneMinder before version 1.34.21, allows remote attackers execute arbitrary code, escalate privileges, and obtain sensitive information via PHP_SELF component in classic/views/download.php.

Affected products

• Zoneminder Zoneminder: before 1.34.21 (fixed in 1.34.21)

Published 2024-04-04. Last modified 2026-06-17.