CVE-2024-22988

ZKteco ZKBio WDMS before 9.0.2 Build 20250526 allows an attacker to download a database backup via the /files/backup/ component because the filename is based on a predictable timestamp.

• CWE-94

• https://gist.github.com/whiteman007/b50a9b64007a5d7bcb7a8bee61d2cb47Third Party Advisory
• https://www.vicarius.io/vsociety/posts/revealing-cve-2024-22988-a-unique-dive-into-exploiting-access-control-gaps-in-zkbio-wdms-uncover-the-untold-crafted-for-beginners-with-a-rare-glimpse-into-pentesting-strategiesThird Party Advisory
• https://www.zkteco.com/en/Security_Bulletinsibs/12
• https://zkteco.comProduct
• https://gist.github.com/whiteman007/b50a9b64007a5d7bcb7a8bee61d2cb47Third Party Advisory
• https://www.vicarius.io/vsociety/posts/revealing-cve-2024-22988-a-unique-dive-into-exploiting-access-control-gaps-in-zkbio-wdms-uncover-the-untold-crafted-for-beginners-with-a-rare-glimpse-into-pentesting-strategiesThird Party Advisory
• https://www.vicarius.io/vsociety/posts/revealing-cve-2024-22988-a-unique-dive-into-exploiting-access-control-gaps-in-zkbio-wdms-uncover-the-untold-crafted-for-beginners-with-a-rare-glimpse-into-pentesting-strategiesThird Party Advisory
• https://www.vicarius.io/vsociety/posts/revealing-cve-2024-22988-a-unique-dive-into-exploiting-access-control-gaps-in-zkbio-wdms-uncover-the-untold-crafted-for-beginners-with-a-rare-glimpse-into-pentesting-strategiesThird Party Advisory
• https://www.vicarius.io/vsociety/posts/revealing-cve-2024-22988-a-unique-dive-into-exploiting-access-control-gaps-in-zkbio-wdms-uncover-the-untold-crafted-for-beginners-with-a-rare-glimpse-into-pentesting-strategiesThird Party Advisory
• https://zkteco.comProduct

Published

Feb 23, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-22957swftools 0.9.2 was discovered to contain an Out-of-bounds Re…5.5
• CVE-2024-2296The Photo Gallery by 10Web – Mobile-Friendly Image Gallery p…4.8
• CVE-2024-2297The Bricks theme for WordPress is vulnerable to Privilege Es…8.8
• CVE-2024-2298The affiliate-toolkit – WordPress Affiliate Plugin plugin fo…4.3
• CVE-2024-22983SQL injection vulnerability in Projectworlds Visitor Managem…8.1
• CVE-2024-22984Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: non…
• CVE-2024-2299A stored Cross-Site Scripting (XSS) vulnerability exists in …6.1
• CVE-2024-2300HP Advance Mobile Applications for iOS and Android are poten…6.2
• CVE-2024-2301Certain HP LaserJet Pro devices are potentially vulnerable t…7.6
• CVE-2024-2302The Easy Digital Downloads – Sell Digital Files & Subscripti…5.3
• CVE-2024-2303The Easy Textillate plugin for WordPress is vulnerable to St…6.4
• CVE-2024-23031Cross Site Scripting (XSS) vulnerability in is_water paramet…6.1