CVE-2022-36635

HighCVSS 8.8

Published: 07/10/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

16.59%

97th percentile - higher than 97% of all known CVEs

Summary

A SQL injection vulnerability was discovered in ZKteco ZKBioSecurity V5000 version 4.1.3 in the /baseOpLog.do component. An attacker can exploit this flaw to manipulate database queries.

Risk Assessment

The risk includes unauthorized access to sensitive data, modification or deletion of records, potentially compromising the integrity and confidentiality of the access control system.

Recommendation

Immediately update ZKBioSecurity V5000 to the latest available version and implement parameterized SQL queries in the /baseOpLog.do component.

Original NVD description (English source)

ZKteco ZKBioSecurity V5000 4.1.3 was discovered to contain a SQL injection vulnerability via the component /baseOpLog.do.