Vulnerabilities

TI-2024-05887 CVE-2024-6344 · GHSA-mcpx-wv4g-3hg5

ZKTeco ZKBio CVSecurity V5000 Push Configuration Section cross site scripting

LOW 22

A vulnerability, which was classified as problematic, was found in ZKTeco ZKBio CVSecurity V5000 4.1.0.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00375 Published 2024-06-26 No fix listed CWE-79

TI-2024-05564 CVE-2024-6006 · GHSA-j6q3-j45m-mw2x

LOW 24

A vulnerability was found in ZKTeco ZKBio CVSecurity V5000 4.1.0.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00428 Published 2024-06-15 No fix listed CWE-79

TI-2024-05563 CVE-2024-6005 · GHSA-g8px-v54r-425j

MEDIUM 56

A vulnerability was found in ZKTeco ZKBio CVSecurity V5000 4.1.0.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00428 Published 2024-06-15 No fix listed CWE-79

TI-2022-16923 CVE-2022-36635 · GHSA-5239-v43c-m59r

MEDIUM 55

ZKteco ZKBioSecurity V5000 4.1.3 was discovered to contain a SQL injection vulnerability via the component /baseOpLog.do.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.17424 Published 2022-10-07 No fix listed CWE-89

TI-2022-16922 CVE-2022-36634 · GHSA-8w2f-h97j-qw93

MEDIUM 41

An access control issue in ZKTeco ZKBioSecurity V5000 3.0.5_r allows attackers to arbitrarily create admin users via a crafted HTTP request.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0125 Published 2022-10-07 No fix listed CWE-863