CVE-2016-20032CWE-79

ZKTeco ZKAccess Security System 5.3.1 Stored XSS

Medium · published March 15, 2026

CVSS v4.0
5.1
EPSS
0%
Percentile
17.2
In the wild
Unconfirmed
What it is

ZKTeco ZKAccess Security System 5.3.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary HTML and script code by injecting malicious payloads through the 'holiday_name' and 'memo' POST parameters. Attackers can submit crafted requests with script code in these parameters to compromise user browser sessions and steal sensitive information.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00264 · 17.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-03-15T13:35Z
EPSS history
Timeline
  • 15 MAR 13:35Z
    ZKTeco ZKAccess Security System 5.3.1 Stored XSS
    cvelistv5