CVE-2021-39434

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A default username and password for an administrator account was discovered in ZKTeco ZKTime 10.0 through 11.1.0, builds 20180901, 20190510.1, 20200309.3, 20200930, 20201231, and 20210220.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-521

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.cnvd.org.cn/flaw/show/CNVD-2018-26041Third Party Advisory
https://www.cnvd.org.cn/flaw/show/CNVD-2018-26041Third Party Advisory

Timeline

Published: Dec 6, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-39446.8bookstack is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-39456.1django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-394586.5Triggering an error page of the import process in Yakamara Media Redaxo CMS version 5.12.1 allows an authenticated CMS user has to alternate CVE-2021-394597.2Remote code execution in the modules component in Yakamara Media Redaxo CMS version 5.12.1 allows an authenticated CMS user to execute code CVE-2021-39475.5A stack-buffer-overflow was found in QEMU in the NVME component. The flaw lies in nvme_changed_nslist() where a malicious guest controlling CVE-2021-394735.4Saibamen HotelManager v1.2 is vulnerable to Cross Site Scripting (XSS) due to improper sanitization of comment and contact fields.CVE-2021-394747.2Vulnerability in the product Docsis 3.0 UBC1319BA00 Router supported affected version 1319010201r009. The vulnerability allows an attacker w CVE-2021-39486.3An incorrect default permissions vulnerability was found in the mig-controller. Due to an incorrect cluster namespaces handling an attacker CVE-2021-394807.5Bingrep v0.8.5 was discovered to contain a memory allocation failure which can cause a Denial of Service (DoS).CVE-2021-394865.4A Stored XSS via Malicious File Upload exists in Gila CMS version 2.2.0. An attacker can use this to steal cookies, passwords or to run arbi CVE-2021-394915.4A Cross Site Scripting (XSS) vulnerability exists in Yogesh Ojha reNgine v1.0 via the Scan Engine name file in the Scan Engine deletion conf CVE-2021-394965.4Eyoucms 1.5.4 lacks sanitization of input data, allowing an attacker to inject malicious code into `filename` param to trigger Reflected XSS