# CVE-2019-7331: zoneminder: Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3 while editing an existing monitor field...

CVE-2019-7331 is fixed in zoneminder on 1 platform by zoneminder 1.32.3-2ubuntu2+esm1 (version 1.32.3-2ubuntu2+esm1), released April 25, 2022. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2019-7331
- Priority: Routine
- CVSS: n/a (Medium)
- EPSS: 0.0090
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Feb 4, 2019

## Description

Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3 while editing an existing monitor field named "signal check color" (monitor.php). There exists no input validation or output filtration, leaving it vulnerable to HTML Injection and an XSS attack.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | zoneminder Ubuntu 20.04 LTS (focal) | 1.32.3-2ubuntu2+esm1 | [zoneminder 1.32.3-2ubuntu2+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-zoneminder-1.32.3-2ubuntu2-esm1.md) | Apr 25, 2022 |

---

Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo