CVE-2019-7332

CVE-2019-7332 describes a reflected Cross-Site Scripting (XSS) vulnerability in ZoneMinder versions up to 1.32.3. This flaw allows an attacker to inject and execute arbitrary HTML or JavaScript code in a victim's browser by manipulating the 'eid' parameter in the download.php script, due to insufficient input sanitization. With a CVSS score of 6.1 (Medium), this vulnerability requires user interaction (UI:R) but can be exploited remotely (AV:N) with low attack complexity (AC:L), potentially leading to limited confidentiality and integrity impacts (C:L/I:L). The EPSS score is very low, suggesting a minimal likelihood of exploitation in the wild. There is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are virtually nonexistent, indicating a lack of widespread attention or concern.