Launchpad.net

CVE 2020-25729

ZoneMinder before 1.34.21 has XSS via the connkey parameter to download.php or export.php.

See the CVE page on Mitre.org for more details.