ZoneMinder before 1.34.21 has XSS via the connkey parameter to download.php or export.php. Read more