CVE-2025-69985

FUXA ≤ 1.2.8 Auth Bypass + RCE CVE-2025-69985 📜 Description This Python exploit targets CVE-2025-69985, a critical authentication bypass vulnerability in FUXA web-based SCADA/HMI software versions ≤ 1.2.8. By sending a crafted JSON payload with embedded Node.js code to the unprotected...

CVE-2025-69985

CVE-2025-69985: Exploit for Authentication Bypass to RCE in FUXA ≤1.2.8 📌 General Description This repository contains a Proof of Concept PoC and detailed technical documentation about the vulnerability CVE-2025-69985 , which affects FUXA versions ≤1.2.8. The vulnerability allows an unauthenticat...

Advisories

Security Advisories This repository includes several vulnerabilities that were discovered and reported during penetration tests. All content in this repository is provided for educational purposes only. Links...

FUXAPWN

CVE-2026-25895 — FUXA = 1.2.9 Unauthenticated Path Traversal to Remote Code Execution Unauthenticated, pre-auth arbitrary file write against FUXA, a Node.js-based SCADA/HMI platform. Chains to remote code execution via several distinct post-write primitives. Works even when secureEnabled = true...

CVE-2026-111163

A flaw was found in wildmidi. An attacker can exploit this vulnerability by supplying a specially crafted HMI audio file to be processed by an application using the library. Due to insufficient boundary checks in the WMParseNewHmi function, the application attempts to read memory beyond the...

EUVD-2026-102290

WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in WMParseNewHmi in src/fhmi.c that reads past buffers when handling 0xfe sub-events. Attackers can supply a crafted HMI file placing a 0xfe 0x10 sub-event near the buffer end to read up to four bytes past the allocation,...

CVE-2026-111163

WildMIDI versions through 0.5.0 are vulnerable to a heap out-of-bounds read in the _WM_ParseNewHmi() function located in src/f_hmi.c. The root cause is improper handling of 0xfe sub-events , where a crafted HMI file containing a 0xfe 0x10 sub-event near the buffer end allows an attacker to read u...

PT-2026-107257

Five more CVE IDs are in. MITRE assigned CVE-2026-95248 and CVE-2026-95250 through CVE-2026-95253 to five findings we published in batch 11 — SCADA/HMI, graph analytics, document viewing and data-centre console management. All five were found, verified and disclosed by our AI-driven research...

CVE-2026-82789

An improper neutralization of directives in dynamically evaluated code 'Eval Injection' issue exists in CONPROSYS HMI SystemCHS. If exploited, arbitrary code may be executed by an attacker who can log in to the product...

CVE-2026-82789

An improper neutralization of directives in dynamically evaluated code 'Eval Injection' issue exists in CONPROSYS HMI SystemCHS. If exploited, arbitrary code may be executed by an attacker who can log in to the product...

CVE-2026-82789

An Eval Injection vulnerability (improper neutralization of directives in dynamically evaluated code) exists in CONPROSYS HMI System (CHS) by CONTEC. A low-privilege attacker who can log in to the product may achieve arbitrary code execution , leading to high impact on confidentiality, integrity,...

CVE-2026-82789

An improper neutralization of directives in dynamically evaluated code 'Eval Injection' issue exists in CONPROSYS HMI SystemCHS. If exploited, arbitrary code may be executed by an attacker who can log in to the product...

EUVD-2026-77243

An improper neutralization of directives in dynamically evaluated code 'Eval Injection' issue exists in CONPROSYS HMI SystemCHS. If exploited, arbitrary code may be executed by an attacker who can log in to the product...

CVE-2026-82789: Improper Neutralization of Directives in Dynamically Evaluated Code

An improper neutralization of directives in dynamically evaluated code 'Eval Injection' issue exists in CONPROSYS HMI SystemCHS. If exploited, arbitrary code may be executed by an attacker who can log in to the product...

PT-2026-91093

An improper neutralization of directives in dynamically evaluated code 'Eval Injection' issue exists in CONPROSYS HMI SystemCHS. If exploited, arbitrary code may be executed by an attacker who can log in to the product...

SIMATIC HMI Unified Comfort Panels Standard unsafe initialization unauthorized access

The vulnerability of the high-performance operator panels from the SIMATIC HMI Unified Comfort Panels Standard family relates to the insecure initialization of resources. Exploiting this vulnerability could allow an intruder to gain unauthorized access to the web browser...

CVE-2026-30512

A local privilege escalation vulnerability exists in the Restricted Access Kiosk Mode implementation of Scheidt & Bachmann entervo HMI prior to V2 R5 P0 M5. The vulnerability affects the external PDF viewer functionality used to display the application manual and its interaction with the underlyi...

CVE-2026-30512: Execution with Unnecessary Privileges

A local privilege escalation vulnerability exists in the Restricted Access Kiosk Mode implementation of Scheidt & Bachmann entervo HMI prior to V2 R5 P0 M5. The vulnerability affects the external PDF viewer functionality used to display the application manual and its interaction with the underlyi...

PT-2026-80881

Name of the Vulnerable Software and Affected Versions Scheidt & Bachmann entervo HMI versions prior to V2 R5 P0 M5 Description A local privilege escalation issue exists in the Restricted Access Kiosk Mode implementation. An authenticated low-privileged user can escape the kiosk environment by...

CVE-2026-30512

A local privilege escalation vulnerability exists in the Restricted Access Kiosk Mode implementation of Scheidt & Bachmann entervo HMI prior to V2 R5 P0 M5. The vulnerability affects the external PDF viewer functionality used to display the application manual and its interaction with the underlyi...