CVE-2026-112247
Received Received - Intake

Cross-Site Scripting in Wuxi Wubang Security Software

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulDB

Description
A weakness has been identified in Wuxi Wubang Security Software Five-in-One Safety Production Management Information System up to 3.5. This affects an unknown function of the file /FCKeditor/editor/filemanager/connectors/aspx/upload.aspx of the component Upload Endpoint. Executing a manipulation of the argument NewFile can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112247
EUVD
EUVD-2026-104527

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
Wuxi Wubang Security Software Five-in-One Safety Production Management Information System 3.0
Wuxi Wubang Security Software Five-in-One Safety Production Management Information System 3.1
Wuxi Wubang Security Software Five-in-One Safety Production Management Information System 3.2
Wuxi Wubang Security Software Five-in-One Safety Production Management Information System 3.3
Wuxi Wubang Security Software Five-in-One Safety Production Management Information System 3.4
Wuxi Wubang Security Software Five-in-One Safety Production Management Information System 3.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stored Cross-Site Scripting (XSS) flaw in Wuxi Wubang Security Software's Five-in-One Safety Production Management Information System up to version 3.5. It allows attackers to upload malicious files, such as SVG files containing JavaScript, via an unauthorized file upload interface. When other users access these files, the embedded script executes in their browser context.

Detection Guidance

Check for the presence of the vulnerable file path /FCKeditor/editor/filemanager/connectors/aspx/upload.aspx. Use tools like curl or wget to test if the upload endpoint is accessible. Example: curl -v http://target/Fckeditor/editor/filemanager/connectors/aspx/upload.aspx. Look for SVG or other file uploads containing JavaScript payloads.

Impact Analysis

An attacker could exploit this to inject malicious scripts into the system. When users access the uploaded files, the scripts could steal session cookies, redirect users to phishing sites, or perform actions on their behalf. This could lead to unauthorized data access or account compromise.

Compliance Impact

This vulnerability could lead to data breaches, exposing sensitive user data. For GDPR, this may result in violations of data protection principles, leading to fines. For HIPAA, it could compromise protected health information, violating compliance requirements and risking penalties.

Mitigation Strategies

Disable or restrict access to the vulnerable upload endpoint. Implement input validation for file uploads to block malicious scripts. Update to the latest version if available. Monitor network traffic for unauthorized file uploads or XSS attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112247. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart