CVE-2026-47720: Improper Neutralization of Special Elements used in an SQL Command

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Prior to 1.3.2, the TDengine DAQ storage connector's escapeTdString function in server/runtime/storage/tdengine/index.js doubles single quotes but does not escape backslashes. A remote unauthenticated attacker can submit a...

CVE-2026-72586 frangoteam FUXA - Missing Authentication on DAQ_QUERY Socket.IO Event Handler

A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DAQQUERY Socket.IO event. When secureEnabled=true, all other sensitive Socket.IO events DEVICEBROWSE, HOSTINTERFACES, DEVICETAGSREQUEST, et...

CVE-2026-72586: Missing Authentication for Critical Function

A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DAQQUERY Socket.IO event. When secureEnabled=true, all other sensitive Socket.IO events DEVICEBROWSE, HOSTINTERFACES, DEVICETAGSREQUEST, et...