# CVE-2016-20027: ZKTeco ZKBioSecurity reflected XSS in multiple scripts

Source: https://junglewise.ai/threats/cve-2016-20027-zkteco-zkbiosecurity-reflected-xss-in-multiple-scripts  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-16. Updated: 2026-06-08  
License: CC BY 4.0 with a link back

CVE-2016-20027 · Severity: medium · CVSS 6.1 · Published 2026-03-16

ZKTeco ZKBioSecurity, a web-based security platform used for access control and visitor management, contains multiple security flaws. These vulnerabilities allow an attacker to trick a user into clicking a malicious link, which then executes unauthorized scripts in the user's web browser. This could lead to the theft of login sessions, unauthorized access to security management features, or the defacement of the web interface.

Technologies: [Zkteco ZKBioSecurity](https://junglewise.ai/threats/technologies/zkbiosecurity). Vendors: [Zkteco](https://junglewise.ai/threats/vendors/zkteco).

## Quick answers

**Is CVE-2016-20027 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-20027 being exploited in the wild.

**How severe is CVE-2016-20027?** Medium severity, with a CVSS score of 6.1, published 16 March 2026.

**Which products and versions are affected?** Zkteco ZKBioSecurity 3.0.1.0_R_230 and earlier.

**Is there a fix for CVE-2016-20027?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2016-20027 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2016-20027?** Check whether you run Zkteco ZKBioSecurity at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Multiple reflected cross-site scripting (XSS) vulnerabilities exist in ZKTeco ZKBioSecurity 3.0 (specifically tested on version 3.0.1.0_R_230). The root cause is the improper sanitization of input parameters in several scripts, including 'authRoleAction!getAll.action' and 'authUserAction!getAll.action'. Specifically, parameters such as 'filter:authGroupSet.id' are vulnerable to payload injection. An unauthenticated remote attacker can exploit these by crafting a malicious URL and enticing a logged-in user to click it. Successful exploitation allows the execution of arbitrary JavaScript in the context of the victim's browser session, potentially leading to session hijacking or unauthorized actions within the application.

## Affected products

- ZKTeco ZKBioSecurity 3.0.1.0_R_230 and earlier

## Timeline

- 2016-07-18: disclosed: Vulnerability discovered by Zero Science Lab
- 2016-08-31: advisory: Public advisory released by CXSecurity/Zero Science Lab
- 2026-03-16: advisory: CVE-2016-20027 published/updated in NVD

## References

- [https://cxsecurity.com/issue/WLB-2016080267](https://cxsecurity.com/issue/WLB-2016080267)
- [https://exchange.xforce.ibmcloud.com/vulnerabilities/116476](https://exchange.xforce.ibmcloud.com/vulnerabilities/116476)
- [https://packetstormsecurity.com/files/138568](https://packetstormsecurity.com/files/138568)
- [https://www.vulncheck.com/advisories/zkteco-zkbiosecurity-multiple-reflected-xss-vulnerabilities](https://www.vulncheck.com/advisories/zkteco-zkbiosecurity-multiple-reflected-xss-vulnerabilities)
- [https://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5363.php](https://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5363.php)

## Related threats

- [ZKTeco ZKBioSecurity auth bypass in visLogin.jsp](https://junglewise.ai/threats/cve-2016-20031-zkteco-zkbiosecurity-auth-bypass-in-vislogin-jsp)
- [ZKTeco ZKBioSecurity user enumeration in authLoginAction](https://junglewise.ai/threats/cve-2016-20030-zkteco-zkbiosecurity-user-enumeration-in-authloginaction)
- [ZKTeco ZKBioSecurity directory traversal in baseAction!getPageXML.action](https://junglewise.ai/threats/cve-2016-20029-zkteco-zkbiosecurity-directory-traversal-in-baseaction-getpagexml)
- [ZKTeco ZKBioSecurity CSRF in superadmin account creation](https://junglewise.ai/threats/cve-2016-20028-zkteco-zkbiosecurity-csrf-in-superadmin-account-creation)
- [ZKTeco ZKBioSecurity hardcoded credentials in bundled Apache Tomcat](https://junglewise.ai/threats/cve-2016-20026-zkteco-zkbiosecurity-hardcoded-credentials-in-bundled-apache)