CVE-2026-76060 — OS Command Injection in PayRange API
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell c…
Published: 2026-08-27 · CVSS: 8.7 · CVSS 4.0
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events permission to execute arbitrary operating system commands on the server.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7