Product by ZKTeco
ZKTeco BioTime
18 known vulnerabilities in ZKTeco BioTime (ZKTeco), 1 of them actively exploited (CISA KEV).
Key figures
18
Vulnerabilities
1
Actively exploited (KEV)
0
Used by ransomware
2
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2023-38950 | ZKTeco BioTime Path Traversal Vulnerability In CISA KEV | 7.5 | |
| Critical | CVE-2023-38951 | ZKTeco BioTime: Path Traversal | 9.8 | |
| High | CVE-2023-38952 | ZKTeco BioTime: security vulnerability | 7.5 | |
| High | CVE-2026-108798 | ZKTeco BioTime hard-coded key | 7.3 | |
| High | CVE-2023-51142 | ZKTeco BioTime: Information Disclosure | 7.5 | |
| Medium | CVE-2026-108794 | ZKTeco BioTime Database Migration Functionality db_migrate_setting sql injection | 6.3 | |
| Medium | CVE-2026-108797 | ZKTeco BioTime Employee REST API employees authorization | 4.3 | |
| Medium | CVE-2026-108795 | ZKTeco BioTime System Settings API systemSettings access control | 4.3 | |
| Medium | CVE-2023-51141 | ZKTeco BioTime: Information Disclosure | 6.5 | |
| Medium | CVE-2026-108796 | ZKTeco BioTime Biometric Data Endpoint finger_data authorization | 4.3 | |
| Medium | CVE-2022-38803 | ZKTeco BioTime: Cross-Site Scripting (XSS) | 6.8 | |
| High | CVE-2024-13966 | ZKTeco BioTime default password | 7.3 | |
| Medium | CVE-2022-38802 | ZKTeco BioTime: Cross-Site Scripting (XSS) | 6.2 | |
| Medium | CVE-2022-30515 | ZKTeco BioTime: Missing Authentication | 5.3 | |
| High | CVE-2023-38949 | ZKTeco BioTime: security vulnerability | 7.5 | |
| Medium | CVE-2025-15128 | ZKTeco BioTime Endpoint safe_setting credentials storage | 5.3 | |
| Medium | CVE-2024-6523 | ZKTeco BioTime system-group-add cross site scripting | 3.5 | |
| Medium | CVE-2022-38801 | ZKTeco BioTime: Cross-Site Scripting (XSS) | 5.4 |