Read the docs
TI-2008-03720 Aliases CVE-2008-3881GHSA-rwrr-6cq9-73w2

Multiple cross-site scripting (XSS) vulnerabilities in ZoneMinder 1.23.3 and earlier…

Priority LOW 22CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · Partial · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Multiple cross-site scripting (XSS) vulnerabilities in ZoneMinder 1.23.3 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified "zm_html_view_*.php" files.

Why it matters now

EPSS 0.01056 64th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 37

CPEVersionsRoleVendor
cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:*up to 1.23.3VulnerableZoneMinder
cpe:2.3:a:zoneminder:zoneminder:0.0.1:*:*:*:*:*:*:*0.0.1VulnerableZoneMinder
cpe:2.3:a:zoneminder:zoneminder:0.9.7:*:*:*:*:*:*:*0.9.7VulnerableZoneMinder
cpe:2.3:a:zoneminder:zoneminder:0.9.8:*:*:*:*:*:*:*0.9.8VulnerableZoneMinder
cpe:2.3:a:zoneminder:zoneminder:0.9.9:*:*:*:*:*:*:*0.9.9VulnerableZoneMinder
cpe:2.3:a:zoneminder:zoneminder:0.9.10:*:*:*:*:*:*:*0.9.10VulnerableZoneMinder
cpe:2.3:a:zoneminder:zoneminder:0.9.11:*:*:*:*:*:*:*0.9.11VulnerableZoneMinder
cpe:2.3:a:zoneminder:zoneminder:0.9.12:*:*:*:*:*:*:*0.9.12VulnerableZoneMinder
cpe:2.3:a:zoneminder:zoneminder:0.9.13:*:*:*:*:*:*:*0.9.13VulnerableZoneMinder
cpe:2.3:a:zoneminder:zoneminder:0.9.14:*:*:*:*:*:*:*0.9.14VulnerableZoneMinder
  • cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:* Versions up to 1.23.3 Vulnerable ·ZoneMinder
  • cpe:2.3:a:zoneminder:zoneminder:0.0.1:*:*:*:*:*:*:* Versions 0.0.1 Vulnerable ·ZoneMinder
  • cpe:2.3:a:zoneminder:zoneminder:0.9.7:*:*:*:*:*:*:* Versions 0.9.7 Vulnerable ·ZoneMinder
  • cpe:2.3:a:zoneminder:zoneminder:0.9.8:*:*:*:*:*:*:* Versions 0.9.8 Vulnerable ·ZoneMinder
  • cpe:2.3:a:zoneminder:zoneminder:0.9.9:*:*:*:*:*:*:* Versions 0.9.9 Vulnerable ·ZoneMinder
  • cpe:2.3:a:zoneminder:zoneminder:0.9.10:*:*:*:*:*:*:* Versions 0.9.10 Vulnerable ·ZoneMinder
  • cpe:2.3:a:zoneminder:zoneminder:0.9.11:*:*:*:*:*:*:* Versions 0.9.11 Vulnerable ·ZoneMinder
  • cpe:2.3:a:zoneminder:zoneminder:0.9.12:*:*:*:*:*:*:* Versions 0.9.12 Vulnerable ·ZoneMinder
  • cpe:2.3:a:zoneminder:zoneminder:0.9.13:*:*:*:*:*:*:* Versions 0.9.13 Vulnerable ·ZoneMinder
  • cpe:2.3:a:zoneminder:zoneminder:0.9.14:*:*:*:*:*:*:* Versions 0.9.14 Vulnerable ·ZoneMinder
Show 27 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:zoneminder:zoneminder:0.9.15:*:*:*:*:*:*:*0.9.15VulnerableZoneMinder
cpe:2.3:a:zoneminder:zoneminder:0.9.16:*:*:*:*:*:*:*0.9.16VulnerableZoneMinder
cpe:2.3:a:zoneminder:zoneminder:1.17.0:*:*:*:*:*:*:*1.17.0VulnerableZoneMinder
cpe:2.3:a:zoneminder:zoneminder:1.17.1:*:*:*:*:*:*:*1.17.1VulnerableZoneMinder
cpe:2.3:a:zoneminder:zoneminder:1.17.2:*:*:*:*:*:*:*1.17.2VulnerableZoneMinder
cpe:2.3:a:zoneminder:zoneminder:1.18.0:*:*:*:*:*:*:*1.18.0VulnerableZoneMinder
cpe:2.3:a:zoneminder:zoneminder:1.18.1:*:*:*:*:*:*:*1.18.1VulnerableZoneMinder
cpe:2.3:a:zoneminder:zoneminder:1.19.0:*:*:*:*:*:*:*1.19.0VulnerableZoneMinder
cpe:2.3:a:zoneminder:zoneminder:1.19.1:*:*:*:*:*:*:*1.19.1VulnerableZoneMinder
cpe:2.3:a:zoneminder:zoneminder:1.19.2:*:*:*:*:*:*:*1.19.2VulnerableZoneMinder
cpe:2.3:a:zoneminder:zoneminder:1.19.3:*:*:*:*:*:*:*1.19.3VulnerableZoneMinder
cpe:2.3:a:zoneminder:zoneminder:1.19.4:*:*:*:*:*:*:*1.19.4VulnerableZoneMinder
cpe:2.3:a:zoneminder:zoneminder:1.19.5:*:*:*:*:*:*:*1.19.5VulnerableZoneMinder
cpe:2.3:a:zoneminder:zoneminder:1.20.0:*:*:*:*:*:*:*1.20.0VulnerableZoneMinder
cpe:2.3:a:zoneminder:zoneminder:1.20.1:*:*:*:*:*:*:*1.20.1VulnerableZoneMinder
cpe:2.3:a:zoneminder:zoneminder:1.21.0:*:*:*:*:*:*:*1.21.0VulnerableZoneMinder
cpe:2.3:a:zoneminder:zoneminder:1.21.1:*:*:*:*:*:*:*1.21.1VulnerableZoneMinder
cpe:2.3:a:zoneminder:zoneminder:1.21.2:*:*:*:*:*:*:*1.21.2VulnerableZoneMinder
cpe:2.3:a:zoneminder:zoneminder:1.21.3:*:*:*:*:*:*:*1.21.3VulnerableZoneMinder
cpe:2.3:a:zoneminder:zoneminder:1.21.4:*:*:*:*:*:*:*1.21.4VulnerableZoneMinder
cpe:2.3:a:zoneminder:zoneminder:1.22.0:*:*:*:*:*:*:*1.22.0VulnerableZoneMinder
cpe:2.3:a:zoneminder:zoneminder:1.22.1:*:*:*:*:*:*:*1.22.1VulnerableZoneMinder
cpe:2.3:a:zoneminder:zoneminder:1.22.2:*:*:*:*:*:*:*1.22.2VulnerableZoneMinder
cpe:2.3:a:zoneminder:zoneminder:1.22.3:*:*:*:*:*:*:*1.22.3VulnerableZoneMinder
cpe:2.3:a:zoneminder:zoneminder:1.23.0:*:*:*:*:*:*:*1.23.0VulnerableZoneMinder
cpe:2.3:a:zoneminder:zoneminder:1.23.1:*:*:*:*:*:*:*1.23.1VulnerableZoneMinder
cpe:2.3:a:zoneminder:zoneminder:1.23.2:*:*:*:*:*:*:*1.23.2VulnerableZoneMinder
  • cpe:2.3:a:zoneminder:zoneminder:0.9.15:*:*:*:*:*:*:* Versions 0.9.15 Vulnerable ·ZoneMinder
  • cpe:2.3:a:zoneminder:zoneminder:0.9.16:*:*:*:*:*:*:* Versions 0.9.16 Vulnerable ·ZoneMinder
  • cpe:2.3:a:zoneminder:zoneminder:1.17.0:*:*:*:*:*:*:* Versions 1.17.0 Vulnerable ·ZoneMinder
  • cpe:2.3:a:zoneminder:zoneminder:1.17.1:*:*:*:*:*:*:* Versions 1.17.1 Vulnerable ·ZoneMinder
  • cpe:2.3:a:zoneminder:zoneminder:1.17.2:*:*:*:*:*:*:* Versions 1.17.2 Vulnerable ·ZoneMinder
  • cpe:2.3:a:zoneminder:zoneminder:1.18.0:*:*:*:*:*:*:* Versions 1.18.0 Vulnerable ·ZoneMinder
  • cpe:2.3:a:zoneminder:zoneminder:1.18.1:*:*:*:*:*:*:* Versions 1.18.1 Vulnerable ·ZoneMinder
  • cpe:2.3:a:zoneminder:zoneminder:1.19.0:*:*:*:*:*:*:* Versions 1.19.0 Vulnerable ·ZoneMinder
  • cpe:2.3:a:zoneminder:zoneminder:1.19.1:*:*:*:*:*:*:* Versions 1.19.1 Vulnerable ·ZoneMinder
  • cpe:2.3:a:zoneminder:zoneminder:1.19.2:*:*:*:*:*:*:* Versions 1.19.2 Vulnerable ·ZoneMinder
  • cpe:2.3:a:zoneminder:zoneminder:1.19.3:*:*:*:*:*:*:* Versions 1.19.3 Vulnerable ·ZoneMinder
  • cpe:2.3:a:zoneminder:zoneminder:1.19.4:*:*:*:*:*:*:* Versions 1.19.4 Vulnerable ·ZoneMinder
  • cpe:2.3:a:zoneminder:zoneminder:1.19.5:*:*:*:*:*:*:* Versions 1.19.5 Vulnerable ·ZoneMinder
  • cpe:2.3:a:zoneminder:zoneminder:1.20.0:*:*:*:*:*:*:* Versions 1.20.0 Vulnerable ·ZoneMinder
  • cpe:2.3:a:zoneminder:zoneminder:1.20.1:*:*:*:*:*:*:* Versions 1.20.1 Vulnerable ·ZoneMinder
  • cpe:2.3:a:zoneminder:zoneminder:1.21.0:*:*:*:*:*:*:* Versions 1.21.0 Vulnerable ·ZoneMinder
  • cpe:2.3:a:zoneminder:zoneminder:1.21.1:*:*:*:*:*:*:* Versions 1.21.1 Vulnerable ·ZoneMinder
  • cpe:2.3:a:zoneminder:zoneminder:1.21.2:*:*:*:*:*:*:* Versions 1.21.2 Vulnerable ·ZoneMinder
  • cpe:2.3:a:zoneminder:zoneminder:1.21.3:*:*:*:*:*:*:* Versions 1.21.3 Vulnerable ·ZoneMinder
  • cpe:2.3:a:zoneminder:zoneminder:1.21.4:*:*:*:*:*:*:* Versions 1.21.4 Vulnerable ·ZoneMinder
  • cpe:2.3:a:zoneminder:zoneminder:1.22.0:*:*:*:*:*:*:* Versions 1.22.0 Vulnerable ·ZoneMinder
  • cpe:2.3:a:zoneminder:zoneminder:1.22.1:*:*:*:*:*:*:* Versions 1.22.1 Vulnerable ·ZoneMinder
  • cpe:2.3:a:zoneminder:zoneminder:1.22.2:*:*:*:*:*:*:* Versions 1.22.2 Vulnerable ·ZoneMinder
  • cpe:2.3:a:zoneminder:zoneminder:1.22.3:*:*:*:*:*:*:* Versions 1.22.3 Vulnerable ·ZoneMinder
  • cpe:2.3:a:zoneminder:zoneminder:1.23.0:*:*:*:*:*:*:* Versions 1.23.0 Vulnerable ·ZoneMinder
  • cpe:2.3:a:zoneminder:zoneminder:1.23.1:*:*:*:*:*:*:* Versions 1.23.1 Vulnerable ·ZoneMinder
  • cpe:2.3:a:zoneminder:zoneminder:1.23.2:*:*:*:*:*:*:* Versions 1.23.2 Vulnerable ·ZoneMinder

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2008-3881
  2. 2026-10-03 Alias added: GHSA-rwrr-6cq9-73w2

References

—

  • TI-2025-40444 ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php. CVSS 3.1CRITICAL 9.8
  • TI-2023-11269 ZoneMinder vulnerable to Missing Authorization CVSS 3.1CRITICAL 9.8
  • TI-2022-18665 Database log access in ZoneMinder CVSS 3.1CRITICAL 9.1
  • TI-2022-12167 ZoneMinder before 1.36.13 allows remote code execution via an invalid language. CVSS 3.1CRITICAL 9.8
  • TI-2024-29012 ZoneMinder Time-based SQL Injection CVSS 3.1CRITICAL 9.8
  • TI-2023-11270 ZoneMinder contains Local File Inclusion vulnerability CVSS 3.1CRITICAL 9.8
See all 84 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences