frangoteam

9 results · Clear filters · Feed

• Critical 9.8
  CVE-2026-42922

  A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A specially…

  frangoteam Frangoteam
  Oct 29, 2026
• Critical 9.2
  CVE-2026-67443

  FUXA: Unauthenticated guest JWT bypasses Node-RED secure-mode authorization gate (Remote Script Execution)

  FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, the allowDashboard authorization gate in server/integrations/node-red/index.js calls authJwt.verify for /nodered without inspecting the decoded identity. When node…

  frangoteam FUXA
  Aug 18, 2026
• Critical 9.5
  CVE-2026-25895 Public exploit Scanner template EPSS 13%

  FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API

  FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. A path traversal vulnerability in FUXA allows an unauthenticated, remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This affects FUXA through ver…

  frangoteam FUXA fuxa-server npm
  Feb 9, 2026
• Critical 9.5
  CVE-2026-25894

  FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration

  FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An insecure default configuration in FUXA allows an unauthenticated, remote attacker to gain administrative access and execute arbitrary code on the server. This affects FUXA through ve…

  frangoteam FUXA fuxa-server npm
  Feb 9, 2026
• Critical 10.0
  CVE-2026-25893

  FUXA Unauthenticated Remote Code Execution via Admin JWT Minting

  FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.2.10, an authentication bypass vulnerability in FUXA allows an unauthenticated, remote attacker to gain administrative access via the heartbeat refresh API and execute arbitr…

  frangoteam FUXA fuxa-server npm
  Feb 9, 2026
• Critical 9.3
  CVE-2026-25939 Public exploit Scanner template EPSS 24%

  FUXA Unauthenticated Remote Arbitrary Scheduler Write

  FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through version 1.2.10, an authorization bypass vulnerability in the FUXA allows an unauthenticated, remote attacker to create and modify arbitrary schedulers, exposing conne…

  frangoteam FUXA fuxa-server npm
  Feb 9, 2026
• Critical 9.5
  CVE-2026-25938 Public exploit

  FUXA Unauthenticated Remote Code Execution in Node-RED Integration

  FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through 1.2.10, an authentication bypass vulnerability in FUXA allows an unauthenticated, remote attacker to execute arbitrary code on the server when the Node-RED plugin is …

  frangoteam FUXA fuxa-server npm
  Feb 9, 2026
• Critical 9.1
  CVE-2026-25751

  FUXA Unauthenticated Exposure of Plaintext Database Credentials

  FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An information disclosure vulnerability in FUXA allows an unauthenticated, remote attacker to retrieve sensitive administrative database credentials. Exploitation allows an unauthentica…

  frangoteam FUXA fuxa-server npm
  Feb 6, 2026
• Critical 9.3
  CVE-2026-25752

  FUXA Unauthenticated Remote Arbitrary Device Tag Write

  FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An authorization bypass vulnerability in FUXA allows an unauthenticated, remote attacker to modify device tags via WebSockets. Exploitation allows an unauthenticated, remote attacker to…

  frangoteam FUXA fuxa-server npm
  Feb 6, 2026