EUVD-2026-125943
GHSA-pg2p-p23v-9vj6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocate exposed /ws.asmx service
-
ExploitInvoke DiyFileUpload method
-
ExecutionUpload unrestricted file (e.g. webshell)
-
ImpactAccess uploaded file to gain foothold
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the application's /ws.asmx web service endpoint and the ability to call its DiyFileUpload function, which performs an upload without restricting file type/content (CWE-434); per the CVSS vector no authentication (PR:N) and no user interaction (UI:N) are needed against affected versions up to 3.5. Limiting factors: the endpoint must be internet- or network-exposed to the attacker; realistic impact (e.g. remote code execution via a planted webshell) depends on whether uploaded files are stored in a web-accessible, executable location, which the available sources do not confirm. No fixed version is identified and the vendor did not respond, so the only scoping limit is the product and version, not a configuration toggle. |
| Impact | Signals are moderate and partially conflicting. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remote, low-complexity, unauthenticated, no-interaction flaw - the easy-access profile that normally drives urgency - yet the same vector scores impact as only Low across confidentiality, integrity and availability (VC:L/VI:L/VA:L), yielding a mid-range 6.9. That impact rating is notably conservative for a CWE-434 unrestricted file upload, which frequently enables webshell deployment and full compromise; the available evidence does not confirm code execution, so the true impact may be understated - verify against the product's handling of uploaded files. There is no CISA KEV listing and no EPSS value in the input, so widespread active exploitation is not evidenced. The exploitation status is 'E:P' (proof-of-concept) and the referenced PoC is a GitHub issue that is not verified as working exploit code, so this is a credible but unproven exploitation risk rather than confirmed in-the-wild attacks. The vuln.today decision label is 'this_month', consistent with a real-but-not-emergency priority. Net: a genuinely remote unauthenticated upload flaw in a niche product - worth patching on a normal cycle, but the obscure footprint and unverified exploit lower real-world urgency relative to the alarming attack-vector metrics. |
| Exploit ScenarioDerived | A remote attacker with no credentials reaches the exposed /ws.asmx web service and invokes the DiyFileUpload function to upload an arbitrary file to the server, bypassing file-type restrictions. Depending on where the file lands and whether it is executable, this could plant a webshell and lead to server compromise. A public PoC reference exists (a GitHub issue), but it is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 14, 2026
Unauthenticated file upload in Wuxi Wubang Security Software's Wubang Five-in-One Safety Production Management Information System (versions up to and including 3.5) allows remote attackers to send arbitrary files to the server through the DiyFileUpload function of the /ws.asmx web service, with no file-type or content restriction (CWE-434). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, E:P) and the independently assessed CVSS 3.1 vector both indicate network-reachable, unauthenticated exploitation with low confidentiality, integrity and availability impact; a planted file becomes far more serious if uploads land in a web-accessible, executable directory, which the available sources do not confirm. A public proof-of-concept reference exists on GitHub (Rookie506/CVE issue 3) but is not verified as working exploit code, there is no CISA KEV listing and no EPSS score in the supplied data, and the vendor did not respond to disclosure, so no fixed version has been published. Priority is rated this_month rather than emergency.
RemediationAI
No vendor-released patch or fixed version was identified at time of analysis: VulDB records that the vendor was contacted early but did not respond, so there is no advisory URL with an upgrade target to cite, and operators should treat any build up to and including 3.5 as unpatched and re-check https://vuldb.com/vuln/437306 for updates. Until a fix appears, the most direct control is to restrict network access to /ws.asmx - put the service behind an allowlist or VPN rather than exposing it to the internet - accepting that this breaks SOAP integrations for any client outside the allowlist. If the DiyFileUpload operation is not used by business processes, disable or remove that web method at the application/server configuration level (for example by removing the operation from the exposed ASMX surface or blocking POSTs to that method at a reverse proxy), with the trade-off that legitimate upload workflows stop working. Where uploads must continue, enforce a strict extension and MIME allowlist for multipart content at a WAF or reverse proxy in front of /ws.asmx, and store uploaded files outside the web root with script execution disabled in the upload directory - a change that may break features relying on serving or executing those files. Because the sources do not confirm where DiyFileUpload stores files or whether that location is executable, treat the execute-denial and path relocation steps as precautions whose operational impact must be tested in staging first.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is an ASP.NET-style .NET web service exposed as /ws.asmx, with the vulnerable operation being the DiyFileUpload method - a custom ("DIY") upload handler in a production-safety management platform. The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type): the handler accepts attacker-supplied file content without enforcing an extension, MIME-type or content allowlist, so the only barrier between a remote caller and file placement on the host is reachability of the SOAP/HTTP endpoint. Because the CVSS vector carries PR:N and UI:N, no credentials or victim interaction are required against affected builds up to 3.5; the CVSS 4.0 E:P rating reflects proof-of-concept maturity, though the public reference (a GitHub issue) is not verified as functional exploit code. The CPE entry (wuxi_wubang_security_software:wubang_five-in-one_safety_production_management_information_system) uses wildcard versioning, so the precise affected build range is defined only by the vendor's "up to 3.5" statement. Whether file placement escalates to code execution depends on the storage path and execution policy of the upload directory, which the available sources do not describe; the assessed impact therefore remains limited (C:L/I:L/A:L) rather than assumed remote code execution.
Know when Wubang Five In One Safety Production Management Information System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Remote, low-complexity, unauthenticated upload with no interaction (AV:N/AC:L/PR:N/UI:N); impact kept Low because the sources confirm only unrestricted upload, not code execution.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A weakness has been identified in Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System up to 3.5. Affected by this vulnerability is the function DiyFileUpload of the file /ws.asmx. This manipulation causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Exploit-DB