Five-in-One System EUVD-2026-104527

Exploitation requires the target to run the FCKeditor file-upload connector at /FCKeditor/editor/filemanager/connectors/aspx/upload.aspx within the Five-in-One Safety Production Management Information System (versions up to 3.5), and requires a victim with access to that endpoint to interact with an attacker-supplied link (UI:P) so the manipulated NewFile value is reflected and executed. Limiting factors: the attack is client-side only (no server-side code execution or data confidentiality/availability impact per VI:L/VC:N/VA:N), depends on tricking a user into following a crafted request, and is constrained to environments where this specific legacy FCKeditor connector is reachable - substantially narrowing real-world impact despite the unauthenticated network vector.

This is a comparatively low real-world priority. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N) yields a base score of 5.3 (Medium), reflecting a reflected cross-site scripting flaw (CWE-79) that is network-reachable and unauthenticated (PR:N) but requires victim user interaction (UI:P) and produces only low integrity impact with no confidentiality or availability impact. The E:A exploit-maturity value corroborates the reported public POC on GitHub. No EPSS score was provided in the input, and the CVE is NOT listed in CISA KEV, so there is no evidence of active exploitation - only publicly available exploit code. The signals are internally consistent (medium CVSS, POC exists, no KEV), pointing to a genuine but low-severity client-side vulnerability rather than a critical server-compromise issue. The most important risk-limiting factors are the required user interaction and the obscurity/limited deployment of the affected product. Note that this was reported by VulDB with no vendor response, so affected-version and fix data are unverified by the vendor.

An attacker crafts a malicious URL targeting /FCKeditor/editor/filemanager/connectors/aspx/upload.aspx with a manipulated NewFile parameter containing script payload, then lures an authenticated operator of the Five-in-One Safety Production Management system into clicking it. When the response reflects the payload, the script executes in the victim's browser session, enabling session/cookie theft or actions in the victim's context. A public proof-of-concept exists (GitHub issue), lowering the barrier to reproduction.