Is CVE-2016-20032 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-20032 being exploited in the wild.

How severe is CVE-2016-20032?

High severity, with a CVSS score of 7.2, published 16 March 2026.

Which products and versions are affected?

Zkteco ZKAccess Security System 5.3.1 (specifically 5.3.12252) and earlier.

Is there a fix for CVE-2016-20032?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2016-20032 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2016-20032?

Check whether you run Zkteco ZKAccess Security System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-20032: ZKTeco ZKAccess Security System stored XSS in AccHolidays

CVE-2016-20032 · Severity: high · CVSS 7.2 · Published 2026-03-16

ZKTeco ZKAccess is a web-based security management system used to monitor and control physical access points like doors and turnstiles. A security flaw allows attackers to inject malicious scripts into the system's database through holiday and memo fields. If an administrator views these records, the script could execute in their browser, potentially allowing the attacker to hijack their session, steal sensitive credentials, or tamper with security settings.

Vendors: Zkteco.

Quick answers

Is CVE-2016-20032 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-20032 being exploited in the wild.
How severe is CVE-2016-20032?: High severity, with a CVSS score of 7.2, published 16 March 2026.
Which products and versions are affected?: Zkteco ZKAccess Security System 5.3.1 (specifically 5.3.12252) and earlier.
Is there a fix for CVE-2016-20032?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2016-20032 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2016-20032?: Check whether you run Zkteco ZKAccess Security System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in ZKTeco ZKAccess Security System version 5.3.1 (tested on build 5.3.12252). The vulnerability is rooted in the lack of proper sanitization of input passed to the 'holiday_name' and 'memo' POST parameters within the AccHolidays component. An attacker can submit a crafted POST request to the /data/iaccess/AccHolidays/_new_/ endpoint containing malicious JavaScript payloads. Because the input is stored and later rendered without encoding, the script executes in the context of any user (typically an administrator) who views the holiday management page. This can lead to session hijacking, unauthorized administrative actions, or information disclosure. The system was observed running on a CherryPy WSGI server with Python 2.6.

Affected products

ZKTeco ZKAccess Security System 5.3.1 (specifically 5.3.12252) and earlier

Timeline

2016-07-18: disclosed: Vulnerability discovered by Zero Science Lab
2016-08-31: advisory: Exploit-DB entry published
2016-09-01: advisory: CXSecurity advisory published
2026-03-16: other: CVE-2016-20032 assigned/published in NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.