PT-2026-25730 · Undefined · Undefined

Published 2026-03-15 · Updated 2026-03-16 · CVE-2016-20032

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ZKTeco ZKAccess Security System version 5.3.1

Description The ZKAccess Security System is susceptible to a stored cross-site scripting issue. This allows attackers to inject malicious payloads through the holiday name and memo POST parameters. Successful exploitation can lead to the execution of arbitrary HTML and script code, potentially compromising user browser sessions and enabling the theft of sensitive information.

Recommendations Apply updates to address the issue in ZKAccess Security System version 5.3.1. Sanitize the holiday name and memo POST parameters to prevent the injection of malicious scripts.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2016-20032

Affected Products

Undefined

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2016-20032 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/116479 · Note
• https://zeroscience.mk/en/vulnerabilities/ZSL-2016-5368.php · Note
• https://cxsecurity.com/issue/WLB-2016090004 · Note
• https://exploit-db.com/exploits/40328 · Note
• https://t.me/CVEtracker/47433 · Telegram Post
• https://vulncheck.com/advisories/zkteco-zkaccess-security-system-stored-xss · Note
• https://packetstormsecurity.com/files/138572 · Note