ZoneMinder versions 1.23.3 and below suffer from command injection, SQL injection, and cross site scripting vulnerabilities.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/69430/zoneminder-multi.txt
Source: https://packetstormsecurity.com/files/69430/zoneminder-multi.txt.html