Submit #986348: Wuxi Wubang Security Software Co., Ltd. Wubang 'Five-in-One' Safety Production Management Information System V3.5 Improper Neutralization of Alternate XSS Syntax

During code audit, an unauthenticated arbitrary file upload endpoint was identified. The endpoint lacks authentication and authorization checks and does not enforce an effective allowlist on file extension, MIME type, or file content. An attacker can directly upload arbitrary XML files. The uploaded XML file is persistently stored on the server and later read, parsed, and displayed in the admin panel or business frontend. Because the frontend does not HTML-entity-encode XML node content before rendering it to the DOM and directly uses innerHTML, an attacker can embed malicious HTML/JavaScript in XML nodes. When an administrator or normal user visits the page containing the XML data, the malicious script executes in the victim's browser context, resulting in stored XSS. This vulnerability can lead to session token/cookie theft, unauthorized administrative actions, sensitive information disclosure, and worm-like propagation. To remediate, add authentication and authorization checks to the upload endpoint, restrict file types and rename/isolate stored files, disable external entities when parsing XML, uniformly encode frontend output, and configure CSP and other mitigations.

• Source: ⚠️ https://github.com/Rookie506/CVE/issues/1
• User: Jreey563 (UID 96485)
• Submission: 09/17/2026 11:10 (1 month ago)
• Moderation: 10/19/2026 14:37 (1 month later)
• Status: Accepted
• VulDB entry: 422321 [Wuxi Wubang Security Software Five-in-One Safety Production Management Information System Upload Endpoint upload.aspx cross site scripting]
• Points: 20