CVE-2016-20030
Critical · 9.8CVSS
9.8
EPSS
0.6%
Published
Mar 16, 2026
CISA due date
—
The record
ZKTeco ZKBioSecurity 3.0 contains a user enumeration vulnerability that allows unauthenticated attackers to discover valid usernames by submitting partial characters via the username parameter. Attackers can send requests to the authLoginAction!login.do script with varying username inputs to enumerate valid user accounts based on application responses.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-106579 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-551
- CVE-2026-16102 A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an… CWE-551
- CVE-2026-15573 A flaw was found in Keycloak's Authorization Services. CWE-551
- CVE-2026-13676 fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN)… CWE-551
- CVE-2026-57920 Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass… CWE-551
- CVE-2026-50559 Quarkus is a Java framework for building cloud-native applications. CWE-551
- CVE-2026-44574 Next.js is a React framework for building full-stack web applications. CWE-551
- CVE-2026-44575 Next.js is a React framework for building full-stack web applications. CWE-551