CVE-2026-112252 SQL injection in Wubang Five-in-One Safety Production Management Information System
Remote attackers can execute arbitrary SQL commands via the ws.asmx endpoint, potentially leading to code execution and data theft.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-112252?
CVE-2026-112252 is a medium-severity SQL injection vulnerability in Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System, published on 19 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability has been found in Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System up to 3.5. Affected is the function xp_cmdshell of the file /ws.asmx. The manipulation of the argument sql leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Which versions are affected by CVE-2026-112252?
How do I fix CVE-2026-112252?
No fix has been published for CVE-2026-112252 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-112252 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-112252 exists.
Sources
Also known as GHSA-x466-v449-jwq8.