CVE-2026-108794: ZKTeco BioTime Database Migration Functionality db_migrate_setting sql injection

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-12 · updated 2026-10-16
Weakness: CWE-74

Description

A security vulnerability has been detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this vulnerability is an unknown functionality of the file /base/api/v1.0/systemSettings/db_migrate_setting/ of the component Database Migration Functionality. Such manipulation leads to sql injection. It is possible to launch the attack remotely. Upgrading to version 9.5.6 Build 3623 addresses this issue. Upgrading the affected component is advised.

Affected products

ZKTeco BioTime: 9.5.6 Build 20260130.3206

References

https://vuldb.com/cve/CVE-2026-108794
https://vuldb.com/submit/961112
https://vuldb.com/vuln/416571
https://vuldb.com/vuln/416571/cti
https://www.zkteco.com/en/Security_Bulletinsibs/27

Get alerted when CVE-2026-108794 or the next vulnerability affects your stack