Skip to content
OpenAdvisories

Package · npm

fuxa-server

21 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.3
    CVE-2026-47721

    FUXA: Scheduler API missing admin check enables operator-to-admin escalation via scheduled device actions

    FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, POST /api/scheduler and DELETE /api/scheduler in server/api/scheduler/index.js do not consistently enforce authJwt.haveAdminPermission for scheduler settings. An authent…

    frangoteam FUXA fuxa-server npm
  • Medium 5.3
    CVE-2026-47720

    FUXA: SQL injection in TDengine DAQ connector via backslash bypass of escapeTdString

    FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the TDengine DAQ storage connector's escapeTdString function in server/runtime/storage/tdengine/index.js doubles single quotes but does not escape backslashes. A remote …

    frangoteam FUXA fuxa-server npm
  • Medium 5.5
    CVE-2026-47718

    FUXA provides guest and invalid-token access to protected read APIs in secure mode

    FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. When `secureEnabled=true`, FUXA `1.3.0-2773` still allows guest and invalid-token requests to read project, alarms, and scheduler APIs. Version 1.3.1 fixes this issue.

    frangoteam FUXA fuxa-server npm