Zkteco Biotime
13 CVEs affecting Zkteco Biotime. Latest disclosed: 2025-12-28. Critical: 1, High: 5.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-38951 | Critical | 9.8 | 2023-08-03 | ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated attackers to create or overwrite arbitrary files on the server via crafted… |
CVE-2023-51142 | High | 7.5 | 2024-04-11 | An issue in ZKTeco BioTime v.8.5.4 and before allows a remote attacker to obtain sensitive information. |
CVE-2023-38952 | High | 7.5 | 2023-08-03 | Insecure access control in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate their privileges due to the fact that session ids are not va… |
CVE-2023-38950 | High | 7.5 | 2023-08-03 | A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplying a crafted payl… |
CVE-2023-38949 | High | 7.5 | 2023-08-03 | An issue in a hidden API in ZKTeco BioTime v8.5.5 allows unauthenticated attackers to arbitrarily reset the Administrator password via a crafted web request. |
CVE-2024-13966 | High | 7.3 | 2025-05-27 | ZKTeco BioTime allows unauthenticated attackers to enumerate usernames and log in as any user with a password unchanged from the default value '123456'. Users… |
CVE-2022-38803 | Medium | 6.8 | 2022-11-30 | Zkteco BioTime < 8.5.3 Build:20200816.447 is vulnerable to Incorrect Access Control via Leave, overtime, Manual log. An authenticated employee can read local f… |
CVE-2023-51141 | Medium | 6.5 | 2024-04-11 | An issue in ZKTeko BioTime v.8.5.4 and before allows a remote attacker to obtain sensitive information via the Authentication & Authorization component |
CVE-2022-38802 | Medium | 6.2 | 2022-11-30 | Zkteco BioTime < 8.5.3 Build:20200816.447 is vulnerable to Incorrect Access Control via resign, private message, manual log, time interval, attshift, and holid… |
CVE-2022-38801 | Medium | 5.4 | 2022-11-30 | In Zkteco BioTime < 8.5.3 Build:20200816.447, an employee can hijack an administrator session and cookies using blind cross-site scripting. |
CVE-2025-15128 | Medium | 5.3 | 2025-12-28 | A vulnerability was detected in ZKTeco BioTime up to 9.0.3/9.0.4/9.5.2. This affects an unknown part of the file /base/safe_setting/ of the component Endpoint… |
CVE-2022-30515 | Medium | 5.3 | 2022-11-08 | ZKTeco BioTime 8.5.4 is missing authentication on folders containing employee photos, allowing an attacker to view them through filename enumeration. |
CVE-2024-6523 | Low | 3.5 | 2024-07-05 | A vulnerability was found in ZKTeco BioTime up to 9.5.2. It has been classified as problematic. Affected is an unknown function of the component system-group-a… |