CVE-2026-108795Medium· 4.3▾ TwilightPoC availableA vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSettings of the component System Settings API. Performing a manipulation results i…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 23.7 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Exploit / PoC code exists
Last analysed / modified upstream
0.2% → 0.3%
A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSettings of the component System Settings API. Performing a manipulation results in improper access controls. The attack can be initiated remotely. Upgrading to version 9.5.6 Build 3623 can resolve this issue. It is advisable to upgrade the affected component.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-108796Medium· 4.3A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206
CVE-2026-108797Medium· 4.3A vulnerability has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206
CVE-2026-108798High· 7.3A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206
CVE-2026-108794Medium· 6.3A security vulnerability has been detected in ZKTeco BioTime 9.5.6 Build 20260130.3206
CVE-2026-116106High· 7.3HeyCyan App FileProvider access control
CVE-2025-10070Medium· 6.3Portabilis i-Educar enturmacao-em-lote access control