CVE-2016-10203: Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject a...

Security readout for executives and security teams

ZoneMinder 1.30 and earlier can accept attacker-supplied script or HTML in a monitor name. If that content is rendered in the application, a user's browser could execute it in the ZoneMinder context. Supplied sources do not provide severity scoring, confirmed exploitation, or a named fixed version. Exposure is most likely where ZoneMinder 1.30 or earlier is deployed and users can create monitors. Risk increases if the ZoneMinder web interface is reachable by untrusted users or weakly segmented from broader networks. Prioritize if ZoneMinder is internet-exposed, manages sensitive camera feeds, or allows non-admin monitor creation. With no CVSS, KEV, or fix details in the supplied sources, urgency should be driven by exposure and privilege model. Mitigation focus: Identify all ZoneMinder deployments and confirm whether versions are 1.30 or earlier.; Check ZoneMinder vendor guidance and release notes for the appropriate fixed version.; Restrict ZoneMinder web access to trusted administrators and management networks..

Prepared

Jun 13, 2026, 06:02 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.