CVE-2016-20032

Name of the Vulnerable Software and Affected Versions ZKTeco ZKAccess Security System version 5.3.1

Description The ZKAccess Security System is susceptible to a stored cross-site scripting issue. This allows attackers to inject malicious payloads through the holiday name and memo POST parameters. Successful exploitation can lead to the execution of arbitrary HTML and script code, potentially compromising user browser sessions and enabling the theft of sensitive information.

Recommendations Apply updates to address the issue in ZKAccess Security System version 5.3.1. Sanitize the holiday name and memo POST parameters to prevent the injection of malicious scripts.