{"id":"CVE-2026-129262","kind":"vulnerability","aliases":["CVE-2026-129262"],"related":[],"title":"Wubang safety management system: unrestricted file upload lets remote users plant files","description":"A weakness has been identified in Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System up to 3.5. Affected by this vulnerability is the function DiyFileUpload of the file /ws.asmx. This manipulation causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"The Wubang Five-in-One Safety Production Management Information System up to version 3.5 has an unrestricted upload flaw in its DiyFileUpload function at /ws.asmx. A remote attacker can upload files to the server without restriction, and a public exploit exists.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Wubang Five-in-One Safety Production Management Information System","fixed":[],"affected":"<= 3.5","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["asp.net-webservice","china-industrial","other","safety-management","wubang"],"not_affected_if":["newer-version","no-network-exposure","not-installed"],"how_to_check":"Find the Wubang Five-in-One Safety Production Management Information System and its version; 3.5 or lower is affected. Check whether /ws.asmx is reachable from the internet or untrusted networks, and review the web root and upload folders for unexpected .aspx/.asmx or other executable files. Authentication requirement is not stated by VulDB/NVD.","fix":"No fix: VulDB says the vendor was contacted early and did not respond. Restrict /ws.asmx to trusted networks or block it at a reverse proxy/WAF.","status":"open","published_at":"2026-11-14T17:16:52+00:00","first_seen_at":"2026-11-14T17:31:24+00:00","triaged_at":"2026-11-14T17:31:47+00:00","updated_at":"2026-11-14T17:32:49+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-14T17:31:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Wubang safety management system: unrestricted file upload lets remote users plant files","impact":"high","summary":"The Wubang Five-in-One Safety Production Management Information System up to version 3.5 has an unrestricted upload flaw in its DiyFileUpload function at /ws.asmx. A remote attacker can upload files to the server without restriction, and a public exploit exists.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wubang","safety-management","asp.net-webservice","china-industrial"],"confidence":0.6,"fix_status":"none","needs_auth":"unknown","worst_case":"remote attacker uploads arbitrary files to the server","analyst_note":"Confirm the affected version range and any vendor or CNA fix, and whether the upload requires authentication; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-129262.","how_to_check":"- Look for the Wubang Five-in-One Safety Production Management Information System in your environment and note its version, `3.5` or lower is affected per the sources\n- Check whether `/ws.asmx` is reachable from the internet or untrusted networks\n- unknown whether the sources give a further check","plain_action":"","product_name":"Wubang Five-in-One Safety Production Management Information System","needs_analyst":true,"not_affected_if":["not-installed","newer-version","no-network-exposure"],"who_is_affected":"Organizations running the Wubang Five-in-One Safety Production Management Information System up to version 3.5 that expose its /ws.asmx endpoint. The sources do not say whether the vendor has released a fix, and the vendor did not respond to disclosure.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000782,"input_tokens":4610,"output_tokens":643,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the affected version range and any vendor or CNA fix, and whether the upload requires authentication; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-129262.","search":"'-129262':15A,18A '-2026':14A,17A '/ws.asmx':64B,115C '3.5':53B,103C 'affect':104C 'asp.net':29B 'attack':67B,125C,142C 'avail':133C 'caus':118C 'china':32B 'china-industri':31B 'contact':146C 'could':138C 'cve':13A,16A 'disclosur':150C 'diyfileupload':61B,111C 'earli':147C 'exist':80B 'exploit':79B,122C,129C 'file':6A,12A,70B,114C 'five':21A,42B,93C 'five-in-on':41B,92C 'five-in-one':20A 'flaw':58B 'function':62B,110C 'identifi':85C 'in':22A 'industri':33B 'inform':48B,99C 'information':27A 'let':8A 'made':132C 'manag':3A,37B,47B,98C 'management':26A 'manipul':117C 'one':23A,44B,95C 'plant':11A 'possibl':127C 'product':46B,97C 'production':25A 'public':78B,136C 'remot':9A,66B,121C 'respond':154C 'restrict':75B 'safeti':2A,36B,45B,96C 'safety':24A 'safety-manag':35B 'secur':89C 'server':73B 'softwar':90C 'system':4A,28A,49B,100C 'unrestrict':5A,56B,119C 'upload':7A,57B,69B,120C 'use':140C 'user':10A 'vendor':144C 'version':52B 'vulner':107C 'way':157C 'weak':82C 'webservic':30B 'without':74B 'wubang':1A,19A,38B,40B,88C,91C 'wuxi':87C","nicknames":[],"mitigations":[],"who_affected":"Organizations running the Wubang Five-in-One Safety Production Management Information System (Wuxi Wubang Security Software) up to 3.5 with /ws.asmx reachable by untrusted users. Teams that do not run this product, or that keep the endpoint off the network, can skip it. Sources do not say whether authentication is needed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["fiveinonesafetyproductionmanagementinformationsystem","wubangfiveinonesafetyproductionmanagementinformationsystem"],"ptokens":["five","in","information","management","one","production","safety","system","wubang"],"labels":["aspnetwebservice","chinaindustrial","high","other","safetymanagement","vendor","wubang"],"campaign_type":null,"search_a":"'-129262':15A,18A '-2026':14A,17A 'cve':13A,16A 'file':6A,12A 'five':21A 'five-in-one':20A 'in':22A 'information':27A 'let':8A 'manag':3A 'management':26A 'one':23A 'plant':11A 'production':25A 'remot':9A 'safeti':2A 'safety':24A 'system':4A,28A 'unrestrict':5A 'upload':7A 'user':10A 'wubang':1A,19A","search_b":"'/ws.asmx':64B '3.5':53B 'asp.net':29B 'attack':67B 'china':32B 'china-industri':31B 'diyfileupload':61B 'exist':80B 'exploit':79B 'file':70B 'five':42B 'five-in-on':41B 'flaw':58B 'function':62B 'industri':33B 'inform':48B 'manag':37B,47B 'one':44B 'product':46B 'public':78B 'remot':66B 'restrict':75B 'safeti':36B,45B 'safety-manag':35B 'server':73B 'system':49B 'unrestrict':56B 'upload':57B,69B 'version':52B 'webservic':30B 'without':74B 'wubang':38B,40B","search_c":"'/ws.asmx':115C '3.5':103C 'affect':104C 'attack':125C,142C 'avail':133C 'caus':118C 'contact':146C 'could':138C 'disclosur':150C 'diyfileupload':111C 'earli':147C 'exploit':122C,129C 'file':114C 'five':93C 'five-in-on':92C 'function':110C 'identifi':85C 'inform':99C 'made':132C 'manag':98C 'manipul':117C 'one':95C 'possibl':127C 'product':97C 'public':136C 'remot':121C 'respond':154C 'safeti':96C 'secur':89C 'softwar':90C 'system':100C 'unrestrict':119C 'upload':120C 'use':140C 'vendor':144C 'vulner':107C 'way':157C 'weak':82C 'wubang':88C,91C 'wuxi':87C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T17:16:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129262","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129262","severity":null,"published_at":"2026-11-14T17:16:52+00:00","modified_at":"2026-11-14T17:16:52+00:00","first_seen_at":"2026-11-14T17:31:24+00:00","fetched_at":"2026-11-14T17:31:24+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-129262:3995","url":"https://vuldb.com/vuln/437306","severity":null,"published_at":"2026-11-14T17:32:49+00:00","modified_at":"2026-11-14T17:32:49+00:00","first_seen_at":"2026-11-14T17:32:49+00:00","fetched_at":"2026-11-14T17:32:49+00:00","note":"Per VulDB VDB-437306 (CNA): versions <=3.5, DiyFileUpload at /ws.asmx, CWE-434, public exploit referenced on GitHub (link not retrieved), vendor silent, no fix. NVD page empty. Auth requirement unknown. Nothing verified, no vendor page.","cites":["https://vuldb.com/vuln/437306","https://nvd.nist.gov/vuln/detail/CVE-2026-129262"]}],"documents":[{"id":157239,"url":"https://vuldb.com/vuln/437306","title":"VDB-437306 Wubang DiyFileUpload unrestricted upload","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":157240,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129262","title":"NVD CVE-2026-129262","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}