Vulnerability · Published Oct 12, 2026 · Assigned by VulDB

CVE-2026-108794ZKTeco BioTime Database Migration Functionality db_migrate_setting sql injection

Medium 6.3

In plain English

A medium-severity SQL injection in BioTime from ZKTeco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.2%top 90.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A security vulnerability has been detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this vulnerability is an unknown functionality of the file /base/api/v1.0/systemSettings/db_migrate_setting/ of the component Database Migration Functionality. Such manipulation leads to sql injection. It is possible to launch the attack remotely. Upgrading to version 9.5.6 Build 3623 addresses this issue. Upgrading the affected component is advised.

Affected products (as reported)

Vendor	Product	Versions
ZKTeco	BioTime	9.5.6 Build 20260130.3206

Weakness: CWE-89, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

References

VDB-416571 | ZKTeco BioTime Database Migration Functionality db_migrate_setting sql injection vdb-entry
VDB-416571 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-108794 | CVE Analysis and Report third-party-advisory
Submit #961112 | ZKTeco BioTime 9.5.6 Build 20260130.3206 SQL Injection third-party-advisory
https://www.zkteco.com/en/Security_Bulletinsibs/27 patch