CVE-2023-38952

creationtimestamp| type| source ---|---|--- 2025-05-05 17:48:55+00:00| seen| https://t.me/truesecator/7008 2025-05-05 18:01:11+00:00| seen| https://t.me/icscert/1143 2025-05-06 21:02:16+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3lojrra2oj62q 2025-12-18 21:03:04+00:00|...

CVE-2023-38952

ZKTeco BioTime through version 9.0.1 is vulnerable to insecure access control where session IDs are not validated against user types. This allows authenticated attackers to perform privilege escalation by making direct requests to administrative endpoints, bypassing restrictions between non-admin...