ZoneMinder prior to 1.34.21 has XSS via the connkey parameter to download.php or export.php.
zoneminder zoneminder