CVE-2026-112247: Cross Site Scripting in Wuxi Wubang Security Software Five-in-One Safety Production Management Information System

This vulnerability affects the Five-in-One Safety Production Management Information System by Wuxi Wubang Security Software in versions 3.0 to 3.5. It involves a cross-site scripting issue in the Upload Endpoint component's upload.aspx file, where the NewFile parameter is not properly sanitized, allowing remote attackers to inject malicious scripts. The vulnerability is remotely exploitable without privileges or user interaction, but requires the victim to interact with the malicious payload (UI required). The vendor was notified but did not provide a response or patch. Public exploit code is available.

Successful exploitation allows remote attackers to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability does not require privileges or authentication to exploit but does require user interaction. There is no indication of direct impact on confidentiality, integrity, or availability beyond the XSS effects.

No official fix or patch is currently available as the vendor has not responded to the disclosure. Users should apply general XSS mitigations such as input validation and output encoding on the NewFile parameter if possible. Monitoring for suspicious activity related to this endpoint is recommended. Since exploit code is public, caution and defensive measures are advised until a vendor patch is released.