https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-45746.htmlhttps://patchthecve.com/cve/CVE-2025-45746.htmlWed, 17 Jun 2026 09:25:39 +0000MEDIUM 6.5: In ZKT ZKBio CVSecurity 6.4.1_R an unauthenticated attacker can craft JWT token using the hardcoded secret to authenticate to the service console. NOTE: the Supplier disputes the significance of this report because the service console is typically only accessible from a local area network, and becauhttps://patchthecve.com/cve/CVE-2024-36526.htmlhttps://patchthecve.com/cve/CVE-2024-36526.htmlWed, 17 Jun 2026 07:36:53 +0000CRITICAL 9.8: ZKTeco ZKBio CVSecurity v6.1.1 was discovered to contain a hardcoded cryptographic key.https://patchthecve.com/cve/CVE-2024-35433.htmlhttps://patchthecve.com/cve/CVE-2024-35433.htmlWed, 17 Jun 2026 07:34:55 +0000HIGH 8.1: ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Incorrect Access Control. An authenticated user, without the permissions of managing users, can create a new admin user.https://patchthecve.com/cve/CVE-2024-35431.htmlhttps://patchthecve.com/cve/CVE-2024-35431.htmlWed, 17 Jun 2026 07:34:55 +0000HIGH 7.5: ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via photoBase64. An unauthenticated user can download local files from the server. NOTE: Third parties have indicated other versions are also vulnerable including up to 6.4.1.https://patchthecve.com/cve/CVE-2024-35429.htmlhttps://patchthecve.com/cve/CVE-2024-35429.htmlWed, 17 Jun 2026 07:34:54 +0000MEDIUM 6.5: ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via eventRecord.https://patchthecve.com/cve/CVE-2024-35428.htmlhttps://patchthecve.com/cve/CVE-2024-35428.htmlWed, 17 Jun 2026 07:34:54 +0000HIGH 7.1: ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via BaseMediaFile. An authenticated user can delete local files from the server which can lead to DoS.https://patchthecve.com/cve/CVE-2024-35432.htmlhttps://patchthecve.com/cve/CVE-2024-35432.htmlWed, 17 Jun 2026 07:34:55 +0000MEDIUM 6.1: ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Cross Site Scripting (XSS) via an Audio File. An authenticated user can injection malicious JavaScript code to trigger a Cross Site Scripting.https://patchthecve.com/cve/CVE-2024-35430.htmlhttps://patchthecve.com/cve/CVE-2024-35430.htmlWed, 17 Jun 2026 07:34:55 +0000HIGH 8.1: In ZKTeco ZKBio CVSecurity v6.1.1_R and earlier (fixed in 6.1.3_R) an authenticated user can bypass password checks while exporting data from the application.