Vulnerabilities

A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206.

A vulnerability has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206.

A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206.

A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206.

A security vulnerability has been detected in ZKTeco BioTime 9.5.6 Build 20260130.3206.

An undocumented configuration export port is accessible on some models of ZKTeco CCTV cameras.

ZKTeco ZKAccess Security System 5.3.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary HTML and script code by injecting malicious payloads through the 'holiday_name' and 'm…

ZKTeco ZKBioSecurity 3.0 contains a local authorization bypass vulnerability in visLogin.jsp that allows attackers to authenticate without valid credentials by spoofing localhost requests.

ZKTeco ZKBioSecurity 3.0 contains a user enumeration vulnerability that allows unauthenticated attackers to discover valid usernames by submitting partial characters via the username parameter.

ZKTeco ZKBioSecurity 3.0 contains a file path manipulation vulnerability that allows attackers to access arbitrary files by modifying file paths used to retrieve local resources.

ZKTeco ZKBioSecurity 3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions by tricking logged-in users into visiting malicious websites.

ZKTeco ZKBioSecurity 3.0 contains multiple reflected cross-site scripting vulnerabilities that allow attackers to execute arbitrary HTML and script code by injecting malicious payloads through unsanitized parameters in m…

ZKTeco ZKBioSecurity 3.0 contains hardcoded credentials in the bundled Apache Tomcat server that allow unauthenticated attackers to access the manager application.

ZKTeco ZKAccess Professional 3.5.3 contains an insecure file permissions vulnerability that allows authenticated users to escalate privileges by modifying executable files.

ZKTeco ZKTime.Net 3.0.1.6 contains an insecure file permissions vulnerability that allows unprivileged users to escalate privileges by modifying executable files.

A vulnerability was detected in ZKTeco BioTime up to 9.0.3/9.0.4/9.5.2.

This vulnerability exists in ZKTeco WL20 due to storage of Wi-Fi credentials, configuration data and system data in plaintext within the device firmware.

This vulnerability exists in ZKTeco WL20 due to hard-coded private key stored in plaintext within the device firmware.

This vulnerability exists in ZKTeco WL20 due to hard-coded MQTT credentials and endpoints stored in plaintext within the device firmware.

This vulnerability exists in ZKTeco WL20 due to storage of admin and user credentials without encryption in the device firmware.

ZKTeco BioTime allows unauthenticated attackers to enumerate usernames and log in as any user with a password unchanged from the default value '123456'.

In ZKT ZKBio CVSecurity 6.4.1_R an unauthenticated attacker can craft JWT token using the hardcoded secret to authenticate to the service console.

A vulnerability classified as problematic has been found in ZKTeco ZKBio Time 9.0.1.

ZKteco – CWE 200 Exposure of Sensitive Information to an Unauthorized Actor

Cross Site Scripting vulnerability in ZKTeco WDMS v.5.1.3 Pro allows a remote attacker to execute arbitrary code and obtain sensitive information via a crafted script to the Emp Name parameter.