Live › vulnerability › CVE-2026-112252
Go to dashboardWuxi Wubang Five-in-One Safety Production Management Information System up to version 3.5 has an SQL injection in the sql argument of the xp_cmdshell function in /ws.asmx. A remote attacker can send crafted SQL through that argument, and the xp_cmdshell call can run operating system commands on the database host.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Organizations running the Wubang Five-in-One Safety Production Management Information System up to version 3.5 with the /ws.asmx web service exposed. Systems that do not run this product are not affected.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability has been found in Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System up to 3.5. Affected is the function xp_cmdshell of the file /ws.asmx. The manipulation of the argument sql leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-112252")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.