A stored cross‑site scripting flaw in ZKTeco ZKAccess Security System permits attackers to embed malicious HTML and JavaScript by submitting crafted values for the holiday_name and memo parameters. The injected payload is saved and later rendered to any user who views the affected page, enabling attackers to run arbitrary code within the victim’s browser session and obtain sensitive data present on that page.

This vulnerability affects ZKTeco Inc.’s ZKAccess Security System, version 5.3.1. No other versions are listed as affected in the available data.

The CVSS score of 5.1 places the issue in the Medium severity range, while an EPSS score of less than 1% indicates a low likelihood of exploitation. The vulnerability is not catalogued in CISA’s KEV catalog. Based on the description, the attack vector is remote, relying on an attacker’s ability to send HTTP POST requests containing malicious payloads to the system’s web interface; this inference is made from the mention of POST parameters."