Five In One Safety Production Management Information System
Monthly
Cross-site scripting in the Five-in-One Safety Production Management Information System through version 3.5 allows remote attackers to inject script through the NewFile argument in the legacy FCKeditor ASPX upload connector, with exploitation requiring a victim to follow a crafted request to /FCKeditor/editor/filemanager/connectors/aspx/upload.aspx. Publicly available exploit code exists, but no CISA KEV confirmation of active exploitation was provided.
Cross-site scripting in the Five-in-One Safety Production Management Information System through version 3.5 allows remote attackers to inject script through the NewFile argument in the legacy FCKeditor ASPX upload connector, with exploitation requiring a victim to follow a crafted request to /FCKeditor/editor/filemanager/connectors/aspx/upload.aspx. Publicly available exploit code exists, but no CISA KEV confirmation of active exploitation was provided.