CVE-2016-20032: ZKTeco ZKAccess Security System 5.3.1 Stored XSS

Published Mar 15, 2026

Updated

ZKTeco ZKAccess Security System 5.3.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary HTML and script code by injecting malicious payloads through the 'holidayname' and 'memo' POST parameters. Attackers can submit crafted requests with script code in these parameters to compromise user browser sessions and steal sensitive information.

Affected Software

1 affected component

ZKTeco ZKAccess Security System

Remediation

Information

The affected software ZKBioSecurity and ZKAccess have been officially discontinued. It is recommended that users switch to using ZKBio CVSecurity software. ZKBio CVSecurity has fixed these vulnerabilities. It is recommended that customers use the latest version of ZKBio CVSecurity to eliminate risks.

Event History

Mar 15, 2026

CVE Published

via MITRE·01:35 PM

Data Sourced

via MITRE·01:35 PM

RemedyDescriptionSeverityWeakness

Mar 16, 2026

Data Sourced

via NVD·02:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2016-20032?

CVE-2016-20032 is classified as a medium severity vulnerability due to its exploitation potential in stored cross-site scripting.

How do I fix CVE-2016-20032?

To fix CVE-2016-20032, ensure input validation and sanitization is implemented for the 'holiday_name' and 'memo' POST parameters.

What type of vulnerability is CVE-2016-20032?

CVE-2016-20032 is a stored cross-site scripting vulnerability that allows for the injection of malicious scripts.

Which software is affected by CVE-2016-20032?

CVE-2016-20032 affects ZKTeco ZKAccess Security System version 5.3.1.

What are the potential impacts of CVE-2016-20032?

The potential impacts of CVE-2016-20032 include unauthorized execution of scripts and theft of sensitive information by attackers.