ZKTeco ZKBioSecurity 3.0 contains several reflected cross‑site scripting weaknesses that allow an attacker to inject arbitrary HTML and JavaScript code by supplying malicious payloads in unsanitized URL parameters. When a user visits a crafted URL, the application echoes the malicious input without proper filtering, enabling the attacker to run code in the victim’s browser within the context of the affected application.

The vulnerability affects ZKTeco Inc.’s ZKBioSecurity 3.0 system. No additional version qualifiers are provided in the advisory.

The CVSS score of 5.1 indicates a moderate risk. Exploitation is possible only when a user accesses a specially crafted web URL, meaning it is a remote web‑based attack. The EPSS score of less than 1% suggests that the likelihood of exploitation is low at present, and the vulnerability is not listed in the CISA KEV catalog. The potential impact is confined to the victim browser session, where an attacker could execute arbitrary code, steal session information, or deface the application’s UI.