CVE-2016-20032: ZKTeco Inc ZKTeco Zkaccess Security System

High severity, CVSS 7.2. EPSS: 0.3% chance of exploitation in the next 30 days.

ZKTeco ZKAccess Security System 5.3.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary HTML and script code by injecting malicious payloads through the 'holiday_name' and 'memo' POST parameters. Attackers can submit crafted requests with script code in these parameters to compromise user browser sessions and steal sensitive information.

Affected products

• ZKTeco Inc ZKTeco Zkaccess Security System: version 5.3.1 only

Published 2026-03-16. Last modified 2026-06-17.