EUVD-2016-10819Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 3.1 score of 7.2 (High) reflects network-based attack vector with no authentication required (AV:N/PR:N), low complexity (AC:L), and scope change (S:C) impacting confidentiality and integrity. The lack of EPSS data and absence from CISA KEV catalog suggests limited real-world exploitation despite public POCs being available since 2016. The primary risk factors are: 1) Multiple public exploits available on Exploit-DB and PacketStorm, 2) No authentication required, 3) Affects security-critical access control systems. However, the 8-year age of this CVE without KEV inclusion suggests targeted rather than mass exploitation. |
| Exploit ScenarioDerived | An unauthenticated remote attacker can send a crafted POST request to the ZKAccess web interface with malicious JavaScript in the 'holiday_name' or 'memo' fields when creating or editing holiday entries. The script is stored in the database and executes when any user (including administrators) views the holiday management page. This could steal session cookies, capture keystrokes, or redirect users to phishing sites. Given that this system manages physical access control, compromised admin sessions could lead to unauthorized building access. Public exploits demonstrate simple payload injection like '<script>alert('XSS')</script>' in the vulnerable parameters. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 15, 2026
Stored cross-site scripting (XSS) vulnerability in ZKTeco ZKAccess Security System 5.3.1 that allows remote attackers to inject malicious scripts via the 'holiday_name' and 'memo' POST parameters without authentication. Multiple public proof-of-concept exploits are available, making this vulnerability actively exploitable in unpatched systems.
RemediationAI
No specific patch information is available in the provided references. Recommended actions: 1) Contact ZKTeco support for updates beyond version 5.3.1, 2) Implement input validation and output encoding for the 'holiday_name' and 'memo' parameters as immediate mitigation, 3) Deploy a Web Application Firewall (WAF) to filter XSS payloads, 4) Restrict network access to the ZKAccess management interface to trusted IP addresses only. The vendor advisory link (vulncheck.com) should be consulted for potential updates.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability affects ZKTeco ZKAccess Security System version 5.3.1 and potentially earlier versions (CPE indicates all versions with wildcard). The CWE-79 classification indicates improper neutralization of user-supplied input before outputting it to web pages. The system fails to sanitize the 'holiday_name' and 'memo' POST parameters, allowing JavaScript and HTML injection that persists in the database (stored XSS). ZKAccess is a physical access control and time attendance management system, making this particularly concerning as it could compromise security infrastructure.
Know when Zkteco Zkaccess Security System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
ZKTeco ZKAccess Security System 5.3.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary HTML and script code by injecting malicious payloads through the 'holiday_name' and 'memo' POST parameters. Attackers can submit crafted requests with script code in these parameters to compromise user browser sessions and steal sensitive information.
Executive ViewAI
ZKTeco ZKAccess Security System 5.3.1 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts into user sessions, potentially compromising employee access control data and enabling credential theft. This affects all organizations using this system version, with active public exploits increasing immediate risk exposure.
Implement Web Application Firewall (WAF) rules to sanitize or block POST requests containing script tags in 'holiday_name' and 'memo' parameters; disable or restrict access to holiday/memo configuration features if operationally feasible; apply strict input validation and HTML entity encoding on affected parameters; enforce Content Security Policy (CSP) headers to prevent inline script execution; segment ZKAccess system on isolated network with limited admin access; monitor and log all administrative access to the system; conduct daily reviews of access logs for anomalous activity. Contact ZKTeco for patch availability status and estimated release date.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Exploit-DB
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
GitHub PoC