CVE-2025-65791
ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php. The application passes unsanitized user input directly to the exec() function. NOTE: this is dispu…
Published: 2026-02-18 · CVSS: 9.8 · CVSS 3.1
ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php. The application passes unsanitized user input directly to the exec() function. NOTE: this is disputed by the Supplier because there is no unsanitized user input to web/views/image.php.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7