CVE-2026-112247 Wuxi Wubang Security Software CVE debrief

Who should care

Defenders responsible for Wuxi Wubang Security Software Five-in-One Safety Production Management Information System up to 3.5 should assess exposure and verify the effectiveness of current security controls.

Why it matters

CVE-2026-112247 is a cross-site scripting vulnerability in Wuxi Wubang Security Software Five-in-One Safety Production Management Information System up to 3.5. Defenders should prioritize verifying exposure and assessing the effectiveness of current security controls.

• Verify exposure of the Upload Endpoint
• Assess effectiveness of current security controls
• Monitor for potential attacks using the exploit

Technical summary

The vulnerability is located in the Upload Endpoint of Wuxi Wubang Security Software Five-in-One Safety Production Management Information System up to 3.5, specifically in the file /FCKeditor/editor/filemanager/connectors/aspx/upload.aspx. The weakness can be exploited remotely by manipulating the argument NewFile, leading to cross-site scripting. Defenders should prioritize verifying exposure of the Upload Endpoint and assess the effectiveness of current security controls. The exploit has been made available to the public, and defenders should monitor for potential attacks. The CVE record and NVD entry provide details about the vulnerability, but the vendor did not respond to the disclosure.

Defensive priority

Defenders should prioritize verifying exposure of the Upload Endpoint in Wuxi Wubang Security Software Five-in-One Safety Production Management Information System up to 3.5 and assess the effectiveness of current security controls.

Recommended defensive actions

• Verify exposure of the Upload Endpoint in Wuxi Wubang Security Software Five-in-One Safety Production Management Information System up to 3.5
• Assess the effectiveness of current security controls
• Monitor for potential attacks using the exploit
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, but the vendor did not respond to the disclosure. The exploit has been made available to the public, but there is no information on actual attacks or victims.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.