Exploited vulnerability

CVE-2026-112247

TLP:CLEAR

wuxi_wubang_security_software five-in-one_safety_production_management_information_system Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

A weakness has been identified in Wuxi Wubang Security Software Five-in-One Safety Production Management Information System up to 3.5. This affects an unknown function of the file /FCKeditor/editor/filemanager/connectors/aspx/upload.aspx of the component Upload Endpoint. Executing a manipulation of the argument NewFile can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Facts

Vendor: Wuxi Wubang Security Software
Product: Five-in-One Safety Production Management Information System
EPSS (probability of exploitation within 30 days): 0.3 %
First known exploitation: 19 October 2026
First seen by Risk Letters: 19 October 2026

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD