CVE-2016-20028

🗓️ 15 Mar 2026 13:35:23Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 7 Views🌐 WEB

ZKTeco ZKBioSecurity 3.0 CSRF lets attackers add superadmin accounts by tricking users, enabling admin access.

Reporter	Title	Published	Views	Family All 9
ATTACKERKB	CVE-2016-20028	15 Mar 202613:35	–	attackerkb
CNNVD	ZKTeco ZKBioSecurity 跨站请求伪造漏洞	16 Mar 202600:00	–	cnnvd
Cvelist	CVE-2016-20028 ZKTeco ZKBioSecurity 3.0 Cross-Site Request Forgery Superadmin	15 Mar 202613:35	–	cvelist
EUVD	EUVD-2016-10811	16 Mar 202615:30	–	euvd
NVD	CVE-2016-20028	16 Mar 202614:17	–	nvd
OpenVAS	ZKTeco ZKBioSecurity Multiple Vulnerabilities (Jul 2016)	6 Oct 201600:00	–	openvas
Positive Technologies	PT-2026-25726	15 Mar 202600:00	–	ptsecurity
Vulnrichment	CVE-2016-20028 ZKTeco ZKBioSecurity 3.0 Cross-Site Request Forgery Superadmin	15 Mar 202613:35	–	vulnrichment
Zero Science Lab	ZKTeco ZKBioSecurity 3.0 CSRF Add Superadmin Exploit	31 Aug 201600:00	–	zeroscience

Vulners

Node

zkteco zkteco_zkbiosecurityMatch3.0.1.0_r_230

[
  {
    "vendor": "ZKTeco Inc.",
    "product": "ZKTeco ZKBioSecurity",
    "versions": [
      {
        "version": "3.0.1.0_R_230",
        "status": "affected"
      }
    ]
  }
]

Source	Link
vulncheck	www.vulncheck.com/advisories/zkteco-zkbiosecurity-cross-site-request-forgery-superadmin
zeroscience	www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5364.php
exploit-db	www.exploit-db.com/exploits/40325/
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/116477
packetstormsecurity	www.packetstormsecurity.com/files/138569
cxsecurity	www.cxsecurity.com/issue/WLB-2016080268

Parameter	Position	Path	Description	CWE
authUser.username	request body	/authUserAction!edit.action	CSRF endpoint used to add/edit administrative user via a forged form submission.	CWE-352
authUser.loginPwd	request body	/authUserAction!edit.action	CSRF endpoint used to add/edit administrative user via a forged form submission.	CWE-352
repassword	request body	/authUserAction!edit.action	CSRF endpoint used to add/edit administrative user via a forged form submission.	CWE-352
authUser.isActive	request body	/authUserAction!edit.action	CSRF endpoint used to add/edit administrative user via a forged form submission.	CWE-352
authUser.isSuperuser	request body	/authUserAction!edit.action	CSRF endpoint used to add/edit administrative user via a forged form submission.	CWE-352
groupIds	request body	/authUserAction!edit.action	CSRF endpoint used to add/edit administrative user via a forged form submission.	CWE-352
deptIds	request body	/authUserAction!edit.action	CSRF endpoint used to add/edit administrative user via a forged form submission.	CWE-352
areaIds	request body	/authUserAction!edit.action	CSRF endpoint used to add/edit administrative user via a forged form submission.	CWE-352
authUser.email	request body	/authUserAction!edit.action	CSRF endpoint used to add/edit administrative user via a forged form submission.	CWE-352
authUser.name	request body	/authUserAction!edit.action	CSRF endpoint used to add/edit administrative user via a forged form submission.	CWE-352

17 Jun 2026 00:43Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.14.3

CVSS 45.3

EPSS0.00207

SSVC

CWE-352