CVE-2026-51133

Cross Site Scripting vulnerability in za-internet GmbH C-MOR Video Surveillance <= V6.0104 allows a remote attacker to execute arbitrary code via the size parameter in ptzpreset.pml component and the showmovies.pml component. The vulnerability can be exploited to inject malicious script.

An attacker can execute arbitrary code in the victim's browser, potentially leading to session theft, account takeover, or other actions in the context of an authenticated user. In a surveillance system, this could result in unauthorized access to cameras and data.

Update C-MOR Video Surveillance to a version later than V6.0104 if available. Until patched, restrict access to the web interface and consider implementing traffic filtering.