VulnerabilityAnalyzed

CVE-2024-35432

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Cross Site Scripting (XSS) via an Audio File.

MEDIUM 6.1EPSS 0.42%

Does this matter?

Lower severity and a low EPSS score (0.42%). Track it; it rarely justifies an emergency change on its own.

Description

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Cross Site Scripting (XSS) via an Audio File. An authenticated user can injection malicious JavaScript code to trigger a Cross Site Scripting.

CVSS 3.1: 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.42% probability · 35th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: zkteco/zkbio cvsecurity
Source: cve@mitre.org

References

https://github.com/mrojz/ZKT-Bio-CVSecurity/blob/main/CVE-2024-35432.mdExploit
https://github.com/mrojz/ZKT-Bio-CVSecurity/blob/main/CVE-2024-35432.mdExploit

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.