---
id: "CVE-2026-112252"
kind: "vulnerability"
aliases: ["CVE-2026-112252"]
title: "Wubang safety management system: SQL injection in /ws.asmx allows remote command execution"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["asp.net", "safety-management", "sql-server", "vendor", "wubang"]
not_affected_if: ["product-not-installed"]
published_at: "2026-10-19T19:17:27+00:00"
first_seen_at: "2026-10-23T21:57:19+00:00"
updated_at: "2026-10-25T03:22:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112252", "first_seen_at": "2026-10-23T21:57:19+00:00"}]
---

# Wubang safety management system: SQL injection in /ws.asmx allows remote command execution

Wuxi Wubang Five-in-One Safety Production Management Information System up to version 3.5 has an SQL injection in the sql argument of the xp_cmdshell function in /ws.asmx. A remote attacker can send crafted SQL through that argument, and the xp_cmdshell call can run operating system commands on the database host.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- unknown; the vendor did not respond to disclosure, so no patched version is known

## Timeline

- 2026-10-23T21:57:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112252

## From the sources

A vulnerability has been found in Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System up to 3.5. Affected is the function xp_cmdshell of the file /ws.asmx. The manipulation of the argument sql leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_