critical9.8
CVE-2025-65791
ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php.
Impact
ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php. The application passes unsanitized user input directly to the exec() function. NOTE: this is disputed by the Supplier because there is no unsanitized user input to web/views/image.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Zoneminder | Zoneminder | Version 1.36.34 |