Skip to content
OpenAdvisories

Package · npm

fuxa-server

21 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • High 8.2
    CVE-2026-47719

    FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading

    FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY Socket.IO handlers in server/runtime/index.js omit isSocketWriteAuthorized and accept attacker-controlled property.address …

    frangoteam FUXA fuxa-server npm
  • High 7.5
    CVE-2026-47717 Scanner template

    FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations

    FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In fuxa-server version 1.3.0, the GET /api/project endpoint exposes sensitive project configuration data to guest-context requests even when secureEnabled is enabled. Version 1.3.1 fixe…

    frangoteam FUXA fuxa-server npm
  • High 8.9
    CVE-2026-43947

    FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass

    FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an unauthenticated Remote Code Execution vulnerability when `secureEnabled` is set to `true`. The `POST /api/runscript` endpoint checks authorization against the store…

    frangoteam FUXA fuxa-server npm
  • High 7.7
    CVE-2026-43946

    FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue

    FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an authorization bypass in the /api/getTagValue endpoint allows unauthenticated access to tag values when the referenced script does not exist. Version 1.3.1 patches t…

    frangoteam FUXA fuxa-server npm
  • High 8.6
    CVE-2026-25951

    FUXA has a Path Traversal Sanitization Bypass

    FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.2.11, there is a flaw in the path sanitization logic allows an authenticated attacker with administrative privileges to bypass directory traversal protections. By using neste…

    frangoteam FUXA fuxa-server npm
  • High 7.5
    CVE-2025-69981

    FUXA contains an Unrestricted File Upload vulnerability

    FUXA v1.2.7 contains an Unrestricted File Upload vulnerability in the `/api/upload` API endpoint. The endpoint lacks authentication mechanisms, allowing unauthenticated remote attackers to upload arbitrary files. This can be exploited to overwrite critical sy…

    fuxa-server npm
  • High 8.2
    CVE-2025-69983

    FUXA allows Remote Code Execution (RCE) via the project import functionality.

    FUXA v1.2.7 allows Remote Code Execution (RCE) via the project import functionality. The application does not properly sanitize or sandbox user-supplied scripts within imported project files. An attacker can upload a malicious project containing system comman…

    fuxa-server npm
  • High 7.5
    CVE-2023-31718 Public exploit

    FUXA local file inclusion vulnerability

    FUXA <= 1.1.12 is vulnerable to Local via Inclusion via /api/download.

    fuxa-server npm
  • High 7.5
    CVE-2023-31717 Public exploit

    FUXA SQL Injection vulnerability

    A SQL Injection attack in FUXA <= 1.1.12 allows exfiltration of confidential information from the database.

    fuxa-server npm