{"id":"CVE-2022-30768","details":"A Stored Cross Site Scripting (XSS) issue in ZoneMinder 1.36.12 allows an attacker to execute HTML or JavaScript code via the Username field when an Admin (or non-Admin users that can see other users logged into the platform) clicks on Logout. NOTE: this exists in later versions than CVE-2019-7348 and requires a different attack method.","modified":"2026-08-12T03:51:32.162536729Z","published":"2022-11-15T00:00:00Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/30xxx/CVE-2022-30768.json"},"references":[{"type":"WEB","url":"https://medium.com/%40dk50u1/stored-xss-in-zoneminder-up-to-v1-36-12-f26b4bb68c31"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/30xxx/CVE-2022-30768.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30768"},{"type":"PACKAGE","url":"https://github.com/ZoneMinder/zoneminder/releases"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/zoneminder/zoneminder","events":[{"introduced":"3a8c740a691d74ed6e697bc890755bb469f3c19f"},{"last_affected":"3a8c740a691d74ed6e697bc890755bb469f3c19f"}],"database_specific":{"extracted_events":[{"introduced":"1.36.12"},{"last_affected":"1.36.12"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:zoneminder:zoneminder:1.36.12:*:*:*:*:*:*:*"}}],"versions":["1.36.12"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-30768.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}]}