What’s Vulnerable › Vulnerabilities

CVE-2016-20027: ZKTeco ZKBioSecurity 3.0 Multiple Reflected XSS Vulnerabilities

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-16 · updated 2026-06-17
• Weakness: CWE-79

Description

ZKTeco ZKBioSecurity 3.0 contains multiple reflected cross-site scripting vulnerabilities that allow attackers to execute arbitrary HTML and script code by injecting malicious payloads through unsanitized parameters in multiple scripts. Attackers can craft malicious URLs with XSS payloads in vulnerable parameters to execute scripts in a user's browser session within the context of the affected application.

Affected products

• ZKTeco Inc. ZKTeco ZKBioSecurity: 3.0.1.0_R_230

References

• https://cxsecurity.com/issue/WLB-2016080267
• https://exchange.xforce.ibmcloud.com/vulnerabilities/116476
• https://packetstormsecurity.com/files/138568
• https://www.vulncheck.com/advisories/zkteco-zkbiosecurity-multiple-reflected-xss-vulnerabilities
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5363.php

Get alerted when CVE-2016-20027 or the next vulnerability affects your stack