CVE-2016-20032
ZKTeco ZKAccess Security System 5.3.1 Stored XSS
CVSS Score
7.2
EPSS Score
0.0%
EPSS Percentile
0th
ZKTeco ZKAccess Security System 5.3.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary HTML and script code by injecting malicious payloads through the 'holiday_name' and 'memo' POST parameters. Attackers can submit crafted requests with script code in these parameters to compromise user browser sessions and steal sensitive information.
| CWE | CWE-79 |
| Vendor | zkteco inc. |
| Product | zkteco zkaccess security system |
| Published | Mar 15, 2026 |
| Last Updated | Mar 16, 2026 |
Stay Ahead of the Next One
Get instant alerts for zkteco inc. zkteco zkaccess security system
Be the first to know when new high vulnerabilities affecting zkteco inc. zkteco zkaccess security system are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
None
Availability
None
Affected Versions
ZKTeco Inc. / ZKTeco ZKAccess Security System
5.3.12252
References
zeroscience.mk: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5368.php cxsecurity.com: https://cxsecurity.com/issue/WLB-2016090004 exchange.xforce.ibmcloud.com: https://exchange.xforce.ibmcloud.com/vulnerabilities/116479 packetstormsecurity.com: https://packetstormsecurity.com/files/138572 exploit-db.com: https://www.exploit-db.com/exploits/40328/ vulncheck.com: https://www.vulncheck.com/advisories/zkteco-zkaccess-security-system-stored-xss
Credits
LiquidWorm as Gjoko Krstic of Zero Science Lab