A flaw in the upload.aspx endpoint of Wuxi Wubang Security Software’s Five‑In‑One Safety Production Management Information System permits an attacker to inject malicious script code via the NewFile parameter. The vulnerability arises from insufficient input validation, allowing the script to be executed in the victim’s browser when the endpoint processes the request. The attack can be performed remotely and has publicly available proof‑of‑concept code.

The problem affects Wuxi Wubang Security Software’s Five‑In‑One Safety Production Management Information System versions up to and including 3.5. The vulnerable component is the FCKeditor file manager connector located at /FCKeditor/editor/filemanager/connectors/aspx/upload.aspx.

The CVSS score of 5.3 indicates a moderate risk level. No EPSS data is available, so current exploitation frequency is uncertain. The vulnerability is not listed in the CISA KEV catalog. Because the flaw is triggered by manipulating the NewFile parameter, an attacker only needs network access to the target system, making the attack vector network-based. Publicly shared exploitation code demonstrates that the exploit can be readily deployed.