There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - ZoneMinder through 1.32.3 has SQL Injection via the skins/classic/views/events.php
    filter[Query][terms][0][cnj] parameter. (CVE-2019-8423)

  - An issue was discovered in ZoneMinder v1.32.3. Reflected XSS exists in web/skins/classic/views/plugin.php
    via the zm/index.php?view=plugin pl parameter. (CVE-2019-6777)

  - A stored-self XSS exists in web/skins/classic/views/zones.php of ZoneMinder through 1.32.3, allowing an
    attacker to execute HTML or JavaScript code in a vulnerable field via a crafted Zone NAME to the
    index.php?view=zones&action=zoneImage&mid=1 URI. (CVE-2019-6990)

  - A classic Stack-based buffer overflow exists in the zmLoadUser() function in zm_user.cpp of the zmu binary
    in ZoneMinder through 1.32.3, allowing an unauthenticated attacker to execute code via a long username.
    (CVE-2019-6991)

  - A stored-self XSS exists in web/skins/classic/views/controlcaps.php of ZoneMinder through 1.32.3, allowing
    an attacker to execute HTML or JavaScript code in a vulnerable field via a long NAME or PROTOCOL to the
    index.php?view=controlcaps URI. (CVE-2019-6992)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3 as the view 'events' (events.php)     insecurely displays the limit parameter value, without applying any proper output filtration. This issue     exists because of the function sortHeader() in functions.php, which insecurely returns the value of the     limit query string parameter without applying any filtration. (CVE-2019-7337)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
427121	Alpine: multiple zoneminder packages: security update to 1.36.7-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	5/16/2025	7/2/2026	critical
427121	Alpine: multiple zoneminder packages: security update to 1.36.7-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	5/16/2025	7/2/2026	critical
256875	Linux Distros Unpatched Vulnerability : CVE-2019-7337	Nessus	Misc.	8/27/2025	7/8/2026	medium

Detections

Analytics

Plugins Search

critical

critical

medium