Unauthenticated-RCE-FUXA-CVE-2023-33831

Unauthenticated RCE FUXA CVE-2023-33831 The vulnerability affects FUXA's scripting component, due to lack of control or sanitization on inputs that can be controlled by users, thus allowing the use of dangerous methods that can be scaled for remote code execution. The affected route is...

CVE-2026-43947: Incorrect Authorization

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Version 1.3.0 has an unauthenticated Remote Code Execution vulnerability when secureEnabled is set to true. The POST /api/runscript endpoint checks authorization against the stored script's permission by ID, but when test: tr...

📄 FUX 1.2.8 Authentication Bypass / Remote Command Execution

This Python exploit targets CVE-2025-69985, an authentication bypass in FUXA web-based SCADA/HMI software that allows access to the protected /api/runscript endpoint even when authentication is enabled. By sending a crafted JavaScript payload using childprocess.execSync, it achieves full remote...

CVE-2023-33831

A remote command execution RCE vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request...

CVE-2023-33831: Improper Neutralization of Special Elements used in a Command

A remote command execution RCE vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request...