Zkteco Biotime vulnerabilities

CVE-2023-38950 [HIGH] CWE-22 CVE-2023-38950: A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated att A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload. This vulnerability was fixed in version 9.0.120240617.19506 of ZKBioTime.

CVE-2023-38951 [CRITICAL] CWE-22 CVE-2023-38951: ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated attackers to cre ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated attackers to create or overwrite arbitrary files on the server via crafted requests to /base/sftpsetting/ endpoints that abuse a path traversal issue in the Username field and a lack of input sanitization on the SSH Key field. Overwriting specific files may lead to

CVE-2023-38952 [HIGH] CWE-552 CVE-2023-38952: Insecure access control in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate t Insecure access control in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate their privileges due to the fact that session ids are not validated for the type of user accessing the application by default. Privilege restrictions between non-admin and admin users are not enforced and any authenticated user can leverage admin functio

CVE-2024-13966 [HIGH] CWE-1393 CVE-2024-13966: ZKTeco BioTime allows unauthenticated attackers to enumerate usernames and log in as any user with a ZKTeco BioTime allows unauthenticated attackers to enumerate usernames and log in as any user with a password unchanged from the default value '123456'. Users should change their passwords (located under the Attendance Settings tab as "Self-Password").

CVE-2023-38949 [HIGH] CVE-2023-38949: An issue in a hidden API in ZKTeco BioTime v8.5.5 allows unauthenticated attackers to arbitrarily re An issue in a hidden API in ZKTeco BioTime v8.5.5 allows unauthenticated attackers to arbitrarily reset the Administrator password via a crafted web request.

CVE-2023-51142 [HIGH] CWE-200 CVE-2023-51142: An issue in ZKTeco BioTime v.8.5.4 and before allows a remote attacker to obtain sensitive informati An issue in ZKTeco BioTime v.8.5.4 and before allows a remote attacker to obtain sensitive information.

CVE-2023-51141 [MEDIUM] CWE-639 CVE-2023-51141: An issue in ZKTeko BioTime v.8.5.4 and before allows a remote attacker to obtain sensitive informati An issue in ZKTeko BioTime v.8.5.4 and before allows a remote attacker to obtain sensitive information via the Authentication & Authorization component

CVE-2022-38803 [MEDIUM] CWE-79 CVE-2022-38803: Zkteco BioTime < 8.5.3 Build:20200816.447 is vulnerable to Incorrect Access Control via Leave, overt Zkteco BioTime < 8.5.3 Build:20200816.447 is vulnerable to Incorrect Access Control via Leave, overtime, Manual log. An authenticated employee can read local files by exploiting XSS into a pdf generator when exporting data as a PDF

CVE-2025-15128 [MEDIUM] CWE-255 CVE-2025-15128: A vulnerability was detected in ZKTeco BioTime up to 9.0.3/9.0.4/9.5.2. This affects an unknown part A vulnerability was detected in ZKTeco BioTime up to 9.0.3/9.0.4/9.5.2. This affects an unknown part of the file /base/safe_setting/ of the component Endpoint. Performing a manipulation of the argument backup_encryption_password_decrypt/export_encryption_password_decrypt results in unprotected storage of credentials. Remote exploitation of the attac

CVE-2024-6523 [MEDIUM] CWE-79 CVE-2024-6523: A vulnerability was found in ZKTeco BioTime up to 9.5.2. It has been classified as problematic. Affe A vulnerability was found in ZKTeco BioTime up to 9.5.2. It has been classified as problematic. Affected is an unknown function of the component system-group-add Handler. The manipulation of the argument user with the input alert('XSS') leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the pu

CVE-2022-30515 [MEDIUM] CWE-306 CVE-2022-30515: ZKTeco BioTime 8.5.4 is missing authentication on folders containing employee photos, allowing an at ZKTeco BioTime 8.5.4 is missing authentication on folders containing employee photos, allowing an attacker to view them through filename enumeration.

CVE-2022-38802 [MEDIUM] CWE-79 CVE-2022-38802: Zkteco BioTime < 8.5.3 Build:20200816.447 is vulnerable to Incorrect Access Control via resign, priv Zkteco BioTime < 8.5.3 Build:20200816.447 is vulnerable to Incorrect Access Control via resign, private message, manual log, time interval, attshift, and holiday. An authenticated administrator can read local files by exploiting XSS into a pdf generator when exporting data as a PDF

CVE-2022-38801 [MEDIUM] CWE-79 CVE-2022-38801: In Zkteco BioTime < 8.5.3 Build:20200816.447, an employee can hijack an administrator session and co In Zkteco BioTime < 8.5.3 Build:20200816.447, an employee can hijack an administrator session and cookies using blind cross-site scripting.