CVE-2016-10202

Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the path info to index.php.

• CWE-79

• http://www.openwall.com/lists/oss-security/2017/02/05/1Exploit, Mailing List
• https://www.foxmole.com/advisories/foxmole-2016-07-05.txtExploit, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2017/02/05/1Exploit, Mailing List
• https://www.foxmole.com/advisories/foxmole-2016-07-05.txtExploit, Third Party Advisory

Published

Mar 3, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-10197The search_make_new function in evdns.c in libevent before 2…7.5
• CVE-2016-10198The gst_aac_parse_sink_setcaps function in gst/audioparsers/…
• CVE-2016-10199The qtdemux_tag_add_str_full function in gst/isomp4/qtdemux.…
• CVE-2016-1020Adobe Flash Player before 18.0.0.343 and 19.x through 21.x b…8.8
• CVE-2016-10200Race condition in the L2TPv3 IP Encapsulation feature in the…7
• CVE-2016-10201Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 …
• CVE-2016-10203Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 …
• CVE-2016-10204SQL injection vulnerability in Zoneminder 1.30 and earlier a…
• CVE-2016-10205Session fixation vulnerability in Zoneminder 1.30 and earlie…
• CVE-2016-10206Cross-site request forgery (CSRF) vulnerability in Zoneminde…
• CVE-2016-10207The Xvnc server in TigerVNC allows remote attackers to cause…
• CVE-2016-10208The ext4_fill_super function in fs/ext4/super.c in the Linux…