ZKTeco ZKAccess Security System 5.3.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary HTML and script

BROWSER

ZKTECO

16-03-2026 11:20

CVE-2016-20032 Vulnerabilidad documentada

Sin puntuación

Tags

#site

#cross

#form

#cross-site

#zkteco

#browser

#vulnerability

#cross-site scripting

#attackers

#arbitrary

#steal

#scripting

#security

#malicious

#inject

#execute

#compromise

#allow

#attack

#access

Descripción

ZKTeco ZKAccess Security System 5.3.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary HTML and script code by injecting malicious payloads through the 'holiday_name' 'memo' POST parameters. Attackers can submit crafted requests with in these parameters compromise user browser sessions steal sensitive information.

https://cxsecurity.com/issue/WLB-2016090004

https://exchange.xforce.ibmcloud.com/vulnerabilities/116479

https://packetstormsecurity.com/files/138572

https://www.exploit-db.com/exploits/40328/

https://www.vulncheck.com/advisories/zkteco-zkaccess-security-system-stored-xss

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5368.php

Referencia

Link externo

Ver detalles

Fuente

https://nvd.nist.gov/vuln/detail/CVE-2016-20032

Resultados similares

Coincidentes en almenos en 50% de los tags

16-03-2026 CVE-2016-20031
ZKTeco ZKBioSecurity 3.0 contains a local authorization bypass vulnerability in visLogin.jsp th...
Ver información

16-03-2026 CVE-2016-20030
ZKTeco ZKBioSecurity 3.0 contains a user enumeration vulnerability that allows unauthenticated ...
Ver información