CVE-2019-7330

CVE-2019-7330 describes a reflected Cross-Site Scripting (XSS) vulnerability in ZoneMinder versions up to 1.32.3. This flaw allows an attacker to inject and execute arbitrary HTML or JavaScript code within a victim's browser by manipulating the 'show' parameter in the frame.php view, due to insufficient input sanitization. Rated as MEDIUM severity with a CVSS score of 6.1, the vulnerability requires user interaction (UI:R) but can be exploited remotely (AV:N) with low attack complexity (AC:L), potentially leading to limited impact on confidentiality and integrity (C:L/I:L). There is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit or Nuclei, and it has received negligible community discussion or media coverage.