CVE-2026-129262: Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System ws.asmx DiyFileUpload unrestricted upload
A weakness has been identified in Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System up to 3.5. Affected by this vulnerability is the function DiyFileUpload of the file /ws.asmx. This manipulation causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments should be prioritized for assessment?
Wubang Five-in-One Safety Production Management Information System deployments running version 3.5 or earlier should be assessed, particularly instances whose ws.asmx endpoint is reachable remotely.
What does an attacker need to exploit this issue?
The supplied vector indicates remote exploitation is possible and the CVSS data lists no privileges or user interaction requirements. The issue affects the DiyFileUpload function in ws.asmx.
Is exploit code available?
Yes. The vulnerability information states that a public exploit is available and could be used in attacks.
What should be done if a vendor fix is not available?
The available information does not identify a fix or workaround. Restrict remote access to the affected ws.asmx endpoint where operationally feasible and investigate exposed systems for unauthorized uploaded files.
How can defenders identify potentially affected systems?
Identify installations of the Wubang Five-in-One Safety Production Management Information System at version 3.5 or earlier, then determine whether the ws.asmx service exposes the DiyFileUpload function.