ZKTeco vulnerabilities
37 CVEs and advisories name ZKTeco as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-108798ZKTeco BioTime hard-coded key
- CVE-2026-108797ZKTeco BioTime Employee REST API employees authorization
- CVE-2026-108796ZKTeco BioTime Biometric Data Endpoint finger_data authorization
- CVE-2026-108795ZKTeco BioTime System Settings API systemSettings access control
- CVE-2026-108794ZKTeco BioTime Database Migration Functionality db_migrate_setting sql injection
- CVE-2026-8598Unauthenticated Export Service in ZKTeco CCTV Cameras
- CVE-2016-20032ZKTeco ZKAccess Security System 5.3.1 Stored XSS
- CVE-2016-20031ZKTeco ZKBioSecurity 3.0 Local Authorization Bypass via visLogin.jsp
- CVE-2016-20030ZKTeco ZKBioSecurity 3.0 User Enumeration via authLoginAction
- CVE-2016-20029ZKTeco ZKBioSecurity 3.0 File Path Manipulation Vulnerability
- CVE-2016-20028ZKTeco ZKBioSecurity 3.0 Cross-Site Request Forgery Superadmin
- CVE-2016-20027ZKTeco ZKBioSecurity 3.0 Multiple Reflected XSS Vulnerabilities
- CVE-2016-20026ZKTeco ZKBioSecurity 3.0 Hardcoded Credentials Remote Code Execution
- CVE-2016-20025ZKTeco ZKAccess Professional 3.5.3 Privilege Escalation via Insecure Permissions
- CVE-2016-20024ZKTeco ZKTime.Net 3.0.1.6 Insecure File Permissions Privilege Escalation
- CVE-2025-15128ZKTeco BioTime Endpoint safe_setting credentials storage
- CVE-2025-55280Information Disclosure Vulnerability in ZKTeco WL20
- CVE-2025-55279Hard-coded Private Key Vulnerability in ZKTeco WL20
- CVE-2025-54465Hard-coded Credentials Vulnerability in ZKTeco WL20
- CVE-2025-54464Cleartext Storage Vulnerability in ZKTeco WL20
- CVE-2024-13966ZKTeco BioTime default password
- CVE-2025-45746In ZKT ZKBio CVSecurity 6.4.1_R an unauthenticated attacker can craft JWT token using the hardcoded secret to authenticate to the service co
- CVE-2024-11049ZKTeco ZKBio Time Image File photo direct request
- CVE-2024-45250ZKteco – CWE 200 Exposure of Sensitive Information to an Unauthorized Actor
- CVE-2024-6523ZKTeco BioTime system-group-add cross site scripting
- CVE-2024-6344ZKTeco ZKBio CVSecurity V5000 Push Configuration Section cross site scripting
- CVE-2024-6006ZKTeco ZKBio CVSecurity V5000 Summer Schedule cross site scripting
- CVE-2024-6005ZKTeco ZKBio CVSecurity V5000 Department Section cross site scripting
- CVE-2023-3943Multiple buffer overflow in ZkTeco-based OEM devices
- CVE-2023-3942Multiple SQLi in ZkTeco-based OEM devices