CVE-2026-112247: Wuxi Wubang Security Software Five-in-One Safety Production Management Information System Upload Endpoint upload.aspx cross site scripting
A weakness has been identified in Wuxi Wubang Security Software Five-in-One Safety Production Management Information System up to 3.5. This affects an unknown function of the file /FCKeditor/editor/filemanager/connectors/aspx/upload.aspx of the component Upload Endpoint. Executing a manipulation of the argument NewFile can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments should be considered exposed?
The affected product is reported as vulnerable through version 3.5. Exposure specifically involves the ASPX upload endpoint at /FCKeditor/editor/filemanager/connectors/aspx/upload.aspx.
What does an attacker need to exploit this issue?
The attack can be launched remotely and requires manipulation of the NewFile argument. No privileges are indicated, but user interaction is required for the cross-site scripting impact.
Is exploitation likely to be practical?
The attack complexity is rated low, and a public exploit is available. The reported impact is integrity-only, with no confidentiality or availability impact indicated.
What is known about remediation availability?
The vendor was contacted before disclosure but did not respond. The provided information does not identify a vendor fix or workaround.