Skip to content
OpenAdvisories

Package · npm

fuxa-server

21 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Critical 9.5
    CVE-2026-25895 Public exploit Scanner template EPSS 13%

    FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API

    FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. A path traversal vulnerability in FUXA allows an unauthenticated, remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This affects FUXA through ver…

    frangoteam FUXA fuxa-server npm
  • Critical 9.5
    CVE-2026-25894

    FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration

    FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An insecure default configuration in FUXA allows an unauthenticated, remote attacker to gain administrative access and execute arbitrary code on the server. This affects FUXA through ve…

    frangoteam FUXA fuxa-server npm
  • Critical 10.0
    CVE-2026-25893

    FUXA Unauthenticated Remote Code Execution via Admin JWT Minting

    FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.2.10, an authentication bypass vulnerability in FUXA allows an unauthenticated, remote attacker to gain administrative access via the heartbeat refresh API and execute arbitr…

    frangoteam FUXA fuxa-server npm
  • Critical 9.3
    CVE-2026-25939 Public exploit Scanner template EPSS 24%

    FUXA Unauthenticated Remote Arbitrary Scheduler Write

    FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through version 1.2.10, an authorization bypass vulnerability in the FUXA allows an unauthenticated, remote attacker to create and modify arbitrary schedulers, exposing conne…

    frangoteam FUXA fuxa-server npm
  • Critical 9.5
    CVE-2026-25938 Public exploit

    FUXA Unauthenticated Remote Code Execution in Node-RED Integration

    FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through 1.2.10, an authentication bypass vulnerability in FUXA allows an unauthenticated, remote attacker to execute arbitrary code on the server when the Node-RED plugin is …

    frangoteam FUXA fuxa-server npm
  • Critical 9.1
    CVE-2026-25751

    FUXA Unauthenticated Exposure of Plaintext Database Credentials

    FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An information disclosure vulnerability in FUXA allows an unauthenticated, remote attacker to retrieve sensitive administrative database credentials. Exploitation allows an unauthentica…

    frangoteam FUXA fuxa-server npm
  • Critical 9.3
    CVE-2026-25752

    FUXA Unauthenticated Remote Arbitrary Device Tag Write

    FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An authorization bypass vulnerability in FUXA allows an unauthenticated, remote attacker to modify device tags via WebSockets. Exploitation allows an unauthenticated, remote attacker to…

    frangoteam FUXA fuxa-server npm
  • Critical 9.3
    CVE-2025-69970

    FUXA contains an insecure default configuration vulnerability

    FUXA v1.2.7 contains an insecure default configuration vulnerability in server/settings.default.js. The 'secureEnabled' flag is commented out by default, causing the application to initialize with authentication disabled. This allows unauthenticated remote at…

    fuxa-server npm
  • Critical 9.8
    CVE-2023-31719 Public exploit Scanner template EPSS 44%

    FUXA SQL Injection vulnerability

    FUXA <= 1.1.12 is vulnerable to SQL Injection via /api/signin.

    fuxa-server npm