CVE-2024-6523

CVE-2024-6523 is a problematic cross-site scripting (XSS) vulnerability affecting ZKTeco BioTime versions up to 9.5.2. Specifically, an unknown function within the system-group-add Handler component is susceptible to XSS when the 'user' argument is manipulated with malicious script input. This vulnerability has a CVSS score of 5.4 (Medium), indicating it can be exploited remotely with low attack complexity, requiring user interaction, and potentially leading to low impact on confidentiality and integrity. The attack vector is network-based, and authentication is required. While the exploit has been publicly disclosed, there is no evidence of active exploitation (not in KEV or Hot List), and no known Metasploit or Nuclei modules exist. Community discussion and media coverage are minimal, suggesting low current attention.