9 matches found
Unauthenticated-RCE-FUXA-CVE-2023-33831
Unauthenticated RCE FUXA CVE-2023-33831 The vulnerability affects FUXA's scripting component, due to lack of control or sanitization on inputs that can be controlled by users, thus allowing the use of dangerous methods that can be scaled for remote code execution. The affected route is...
CVE-2026-43947: Incorrect Authorization
FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Version 1.3.0 has an unauthenticated Remote Code Execution vulnerability when secureEnabled is set to true. The POST /api/runscript endpoint checks authorization against the stored script's permission by ID, but when test: tr...
FUXA CVE-2025-69985 detection
Fingerprints FUXA SCADA/HMI and flags versions = 1.2.8 affected by CVE-2025-69985 unauthenticated /api/runscript RCE. !/usr/bin/env python3 -- coding: utf-8 -- import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name":...
FUXA <= 1.2.8 Authentication Bypass + RCE (CVE-2025-69985)
Unauthenticated access to the protected /api/runscript endpoint when authentication is enabled, followed by remote command execution via Node.js childprocess.execSync in script code. Fixed in FUXA 1.2.8. !/usr/bin/env python3 -- coding: utf-8 -- import re from kittysploit import from...
📄 FUX 1.2.8 Authentication Bypass / Remote Command Execution
This Python exploit targets CVE-2025-69985, an authentication bypass in FUXA web-based SCADA/HMI software that allows access to the protected /api/runscript endpoint even when authentication is enabled. By sending a crafted JavaScript payload using childprocess.execSync, it achieves full remote...
CVE-2025-69985
FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution RCE. The vulnerability exists in the server/api/jwt-helper.js middleware, which improperly trusts the HTTP "Referer" header to validate internal requests. A remote unauthenticated attacker can...
CVE-2023-33831: Improper Neutralization of Special Elements used in a Command
A remote command execution RCE vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request...
