What is the CVSS score of CVE-2025-65791?

CVE-2025-65791 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.9%.

Which versions of PHP are affected by CVE-2025-65791?

ZoneMinder v1.36.34 contains a critical command injection vulnerability that allows unauthenticated attackers to execute arbitrary commands on affected servers with a 90% probability of exploitation…

Is there a public PoC exploit available for CVE-2025-65791?

Yes, a public proof-of-concept exploit is available for CVE-2025-65791. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2025-65791?

Within 24 hours: Isolate all ZoneMinder v1.36.34 instances from production networks or disable web access until mitigation is confirmed; audit logs for signs of exploitation. Within 7 days: Implement WAF rules to block malicious payloads targeting image.php and restrict access to the application via IP whitelist or VPN only. Within 30 days: Either upgrade to a patched version when available, migrate to an alternative video surveillance platform, or decommission the affected system.

PHP CVE-2025-65791

CRITICAL

OS Command Injection (CWE-78)

2026-02-18 cve@mitre.org

PHP Command Injection Zoneminder

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Mar 11, 2026 - 04:17 vuln.today

Public exploit code

CVE Published

Feb 18, 2026 - 16:22 nvd

CRITICAL 9.8

DescriptionCVE.org

ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php. The application passes unsanitized user input directly to the exec() function. NOTE: this is disputed by the Supplier because there is no unsanitized user input to web/views/image.php.

AnalysisAI

Command injection in ZoneMinder v1.36.34 video surveillance system via web/views/image.php. Unsanitized user input enables unauthenticated remote code execution. PoC available.