CVE-2026-129262
Deferred Deferred - Pending Action

Unrestricted File Upload in Wuxi Wubang Safety System

Publication date: 2026-11-14

Last updated on: 2026-11-14

Assigner: VulDB

Description
A weakness has been identified in Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System up to 3.5. Affected by this vulnerability is the function DiyFileUpload of the file /ws.asmx. This manipulation causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-14
Last Modified
2026-11-14
Generated
2026-11-15
AI Q&A
2026-11-14
EPSS Evaluated
N/A
NVD
CVE-2026-129262
EUVD
EUVD-2026-125943

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unrestricted file upload flaw in Wuxi Wubang Security Software's Wubang Five-in-One Safety Production Management Information System up to version 3.5. It affects the DiyFileUpload function in the /ws.asmx file, allowing attackers to upload arbitrary files without restrictions. The exploit is public and can be used for remote attacks.

Detection Guidance

Check for unusual file uploads to the /ws.asmx endpoint. Monitor network traffic for SOAP requests with the action 'http://tempuri.org/DiyFileUpload'. Look for files named shellhello.aspx or similar in web directories like D:\ComUnifySys\.

Impact Analysis

An attacker could exploit this to upload malicious files like web shells to the server. This could lead to remote code execution, data theft, or full system compromise. The system's integrity and confidentiality would be at risk.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Disable or restrict access to the /ws.asmx endpoint. Implement strict file upload validation to block Base64-encoded payloads and executable files. Update to the latest version if available. Monitor for unauthorized file uploads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-129262. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...