Live › vulnerability › CVE-2026-112247
Go to dashboardThe Five-in-One Safety Production Management Information System up to version 3.5 has a weakness in its FCKeditor upload handler at upload.aspx, where the NewFile argument is not handled safely. A remote attacker can use it to inject script that runs in the browser of a user who opens the affected page, and a public exploit exists.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Organisations running the Wuxi Wubang Five-in-One Safety Production Management Information System up to version 3.5 that expose the FCKeditor filemanager upload connector over the network. Installations where that path is not reachable from untrusted users are less exposed; the sources do not say which configurations are the default.
No product ranges from the sources yet.
/FCKeditor/editor/filemanager/connectors/aspx/upload.aspx (for example with curl -I https://<host>/FCKeditor/editor/filemanager/connectors/aspx/upload.aspx)3.5; the sources say versions up to 3.5 are affected, with no exact build number givenEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A weakness has been identified in Wuxi Wubang Security Software Five-in-One Safety Production Management Information System up to 3.5. This affects an unknown function of the file /FCKeditor/editor/filemanager/connectors/aspx/upload.aspx of the component Upload Endpoint. Executing a manipulation of the argument NewFile can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-112247")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.