BI
Product
BioTime
On CISA KEVExploited in the wild
18
CVEs
1
On KEV
9.8
Max CVSS
5
New 30D
Severity mix
Critical 1High 6Medium 11Low 0
Watch
Add BioTime to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-38950 In wildKEV | 7.5 | Aug 3 | ZKTeco BioTime Path Traversal Vulnerability Affected: before 9.0.1 |
| CVE-2023-38951 | 9.8 | Aug 3 | ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated attackers to create or overwrite arbitrary files on the server via crafted requests to… Affected: 8.5.5 |
| CVE-2023-51142 | 7.5 | Mar 21 | An issue in ZKTeco BioTime v.8.5.4 and before allows a remote attacker to obtain sensitive information Affected: 8.5.4 |
| CVE-2023-38952 | 7.5 | Aug 3 | Insecure access control in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate their privileges due to the fact that session ids are not validated for the type… Affected: 8.5.5 |
| CVE-2023-38949 | 7.5 | Aug 3 | An issue in a hidden API in ZKTeco BioTime v8.5.5 allows unauthenticated attackers to arbitrarily reset the Administrator password via a crafted web request Affected: 8.5.5 |
| CVE-2026-108798 | 7.3 | Oct 12 | ZKTeco BioTime hard-coded key Affected: 9.5.6 Build 20260130.3206 |
| CVE-2024-13966 | 7.3 | May 27 | ZKTeco BioTime default password Affected: before 9.0.4 |
| CVE-2022-38803 | 6.8 | Nov 30 | Zkteco BioTime < 8.5.3 Build:20200816.447 is vulnerable to Incorrect Access Control via Leave, overtime, Manual log Affected: before 8.5.4 |
| CVE-2023-51141 | 6.5 | Mar 21 | An issue in ZKTeko BioTime v.8.5.4 and before allows a remote attacker to obtain sensitive information via the Authentication & Authorization component Affected: 8.5.4 |
| CVE-2026-108794 | 6.3 | Oct 12 | ZKTeco BioTime Database Migration Functionality db_migrate_setting sql injection Affected: 9.5.6 Build 20260130.3206 |
| CVE-2022-38802 | 6.2 | Nov 30 | Zkteco BioTime < 8.5.3 Build:20200816.447 is vulnerable to Incorrect Access Control via resign, private message, manual log, time interval, attshift, and holiday Affected: before 8.5.4 |
| CVE-2024-6523 | 5.4 | Jul 5 | ZKTeco BioTime system-group-add cross site scripting Affected: 9.5.0; 9.5.1; 9.5.2 |
| CVE-2022-38801 | 5.4 | Nov 30 | In Zkteco BioTime < 8.5.3 Build:20200816.447, an employee can hijack an administrator session and cookies using blind cross-site scripting Affected: before 8.5.4 |
| CVE-2025-15128 | 5.3 | Dec 28 | ZKTeco BioTime Endpoint safe_setting credentials storage Affected: 9.0.0; 9.0.1; 9.0.2; 9.0.3; 9.0.4; 9.5.0; +2 more |
| CVE-2022-30515 | 5.3 | Nov 8 | ZKTeco BioTime 8.5.4 is missing authentication on folders containing employee photos, allowing an attacker to view them through filename enumeration Affected: 8.5.4; 8.5.5 |
| CVE-2026-108797 | 4.3 | Oct 12 | ZKTeco BioTime Employee REST API employees authorization Affected: 9.5.6 Build 20260130.3206 |
| CVE-2026-108796 | 4.3 | Oct 12 | ZKTeco BioTime Biometric Data Endpoint finger_data authorization Affected: 9.5.6 Build 20260130.3206 |
| CVE-2026-108795 | 4.3 | Oct 12 | ZKTeco BioTime System Settings API systemSettings access control Affected: 9.5.6 Build 20260130.3206 |
Showing 18