high7.2
CVE-2016-20032
ZKTeco ZKAccess Security System 5.3.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary HTML and script code by i…
Impact
ZKTeco ZKAccess Security System 5.3.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary HTML and script code by injecting malicious payloads through the 'holiday_name' and 'memo' POST parameters. Attackers can submit crafted requests with script code in these parameters to compromise user browser sessions and steal sensitive information.
Affected packages
This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.
Weakness classification
References
- NVD record
- CVE.org record
- https://cxsecurity.com/issue/WLB-2016090004
- https://exchange.xforce.ibmcloud.com/vulnerabilities/116479
- https://packetstormsecurity.com/files/138572
- https://www.exploit-db.com/exploits/40328/
- https://www.vulncheck.com/advisories/zkteco-zkaccess-security-system-stored-xss
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5368.php