includes/database.php in ZoneMinder before 1.32.3 has XSS in the construction of SQL-ERR messages.
{ "urgency": "unimportant" }