---
id: "CVE-2026-112247"
kind: "vulnerability"
aliases: ["CVE-2026-112247"]
title: "Wuxi Wubang safety management system: upload endpoint allows cross-site scripting"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["asp.net", "iis", "safety-management-system", "vendor", "wuxi-wubang"]
not_affected_if: ["path-not-exposed"]
published_at: "2026-10-19T18:17:04+00:00"
first_seen_at: "2026-10-23T21:57:18+00:00"
updated_at: "2026-10-25T04:25:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112247", "first_seen_at": "2026-10-23T21:57:18+00:00"}]
---

# Wuxi Wubang safety management system: upload endpoint allows cross-site scripting

The Five-in-One Safety Production Management Information System up to version 3.5 has a weakness in its FCKeditor upload handler at upload.aspx, where the NewFile argument is not handled safely. A remote attacker can use it to inject script that runs in the browser of a user who opens the affected page, and a public exploit exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the deployment exposes `/FCKeditor/editor/filemanager/connectors/aspx/upload.aspx` (for example with `curl -I https://<host>/FCKeditor/editor/filemanager/connectors/aspx/upload.aspx`)
- Confirm the installed product version against `3.5`; the sources say versions up to 3.5 are affected, with no exact build number given

## Fix

- No fixed version is named in the sources: unknown
- Vendor did not respond to disclosure; block or remove the FCKeditor connector path at the web server or reverse proxy until a patch is confirmed
- Restrict access to the admin and upload pages to trusted networks

## Timeline

- 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112247

## From the sources

A weakness has been identified in Wuxi Wubang Security Software Five-in-One Safety Production Management Information System up to 3.5. This affects an unknown function of the file /FCKeditor/editor/filemanager/connectors/aspx/upload.aspx of the component Upload Endpoint. Executing a manipulation of the argument NewFile can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_