Zkteco · weakness class

SQL Injection

5 CVEs

Every dot is a CVE in what this vendor ships; the named ones are the most at risk.

Connect AI

likely to be exploited: 1

Every one of the 5 is a mark on the map. Named now: 1 to 5, most at risk first.

ZKteco ZKBioSecurity V5000 4.1.3 was discovered to contain a SQL injection vulnerability via the component /baseOpLog.do.CVE-2022-36635Zkteco · 17% likely
CWE-89
ZKTeco BioAccess IVS v3.3.1 was discovered to contain a SQL injection vulnerability.CVE-2023-38954Zkteco · 0.6% likely
CWE-89
Multiple SQLi in ZkTeco-based OEM devicesCVE-2023-3942ZkTeco · CVSS 7.5 · 0.6% likely
CWE-89
Bypassing ZkTeco-based OEM devices/ZKTeco biometric authentication system via SQLi in QR codeCVE-2023-3938ZkTeco · CVSS 4.6 · 0.4% likely
CWE-89
ZKTeco BioTime Database Migration Functionality db_migrate_setting sql injectionCVE-2026-108794ZKTeco · CVSS 6.3 · 0.2% likely
CWE-89

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.