---
id: "CVE-2026-129262"
page: "https://infrastack.ai/live/CVE-2026-129262"
kind: "vulnerability"
aliases: ["CVE-2026-129262"]
title: "Wubang safety management system: unrestricted file upload lets remote users plant files"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Wubang Five-in-One Safety Production Management Information System", "fixed": [], "affected": "<= 3.5", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["asp.net-webservice", "china-industrial", "other", "safety-management", "wubang"]
not_affected_if: ["newer-version", "no-network-exposure", "not-installed"]
published_at: "2026-11-14T17:16:52+00:00"
first_seen_at: "2026-11-14T17:31:24+00:00"
updated_at: "2026-11-14T17:32:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129262", "first_seen_at": "2026-11-14T17:31:24+00:00"}, {"source": "analyst", "url": "https://vuldb.com/vuln/437306", "first_seen_at": "2026-11-14T17:32:49+00:00", "cites": ["https://vuldb.com/vuln/437306", "https://nvd.nist.gov/vuln/detail/CVE-2026-129262"]}]
exploit_sources: []
---

# Wubang safety management system: unrestricted file upload lets remote users plant files

Link for people: https://infrastack.ai/live/CVE-2026-129262 (this .md is for agents)

The Wubang Five-in-One Safety Production Management Information System up to version 3.5 has an unrestricted upload flaw in its DiyFileUpload function at /ws.asmx. A remote attacker can upload files to the server without restriction, and a public exploit exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Wubang Five-in-One Safety Production Management Information System affected <= 3.5 fixed no fixed version listed

## How to check

Find the Wubang Five-in-One Safety Production Management Information System and its version; 3.5 or lower is affected. Check whether /ws.asmx is reachable from the internet or untrusted networks, and review the web root and upload folders for unexpected .aspx/.asmx or other executable files. Authentication requirement is not stated by VulDB/NVD.

## Fix

No fix: VulDB says the vendor was contacted early and did not respond. Restrict /ws.asmx to trusted networks or block it at a reverse proxy/WAF.

## Timeline

- 2026-11-14T17:31:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129262
- 2026-11-14T17:32:49+00:00 analyst https://vuldb.com/vuln/437306 — Per VulDB VDB-437306 (CNA): versions <=3.5, DiyFileUpload at /ws.asmx, CWE-434, public exploit referenced on GitHub (link not retrieved), vendor silent, no fix. NVD page empty. Auth requirement unknown. Nothing verified, no vendor page.

## Documents

- [advisory] VDB-437306 Wubang DiyFileUpload unrestricted upload https://vuldb.com/vuln/437306
- [describes] NVD CVE-2026-129262 https://nvd.nist.gov/vuln/detail/CVE-2026-129262

## From the sources

A weakness has been identified in Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System up to 3.5. Affected by this vulnerability is the function DiyFileUpload of the file /ws.asmx. This manipulation causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_