CVE-2026-72586

A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DAQQUERY Socket.IO event. When secureEnabled=true, all other sensitive Socket.IO events DEVICEBROWSE, HOSTINTERFACES, DEVICETAGSREQUEST, et...

CVE-2026-43947

FUXA vulnerability CVE-2026-43947 affects version 1.3.0 where, when secureEnabled is true, an unauthenticated user can trigger Remote Code Execution via POST /api/runscript with test: true if they know a valid script ID/name and at least one server-side script exists. The attack bypasses authoriz...

PT-2026-44163

Name of the Vulnerable Software and Affected Versions fuxa-server version 1.3.0 Description An API logic flaw in the web-based Process Visualization software allows unauthenticated attackers to leak critical project configurations and operational data. The '/api/project' endpoint exposes sensitiv...

Missing Authorization

Overview fuxa-server is a Web-based Process Visualization SCADA/HMI/Dashboard software Affected versions of this package are vulnerable to Missing Authorization via the WebSocket. An attacker can overwrite arbitrary device tags or disable communication drivers by sending crafted WebSocket message...

Improper Authentication

Overview @frangoteam/fuxa is a Web-based Process Visualization SCADA/HMI/Dashboard software Affected versions of this package are vulnerable to Improper Authentication via the authentication process. An attacker can gain administrative access and execute arbitrary code by bypassing authentication...

FUXA Unauthenticated Remote Code Execution via Admin JWT Minting

Note GitHub incorrectly stated this vulnerability is identical to CVE-2025-69970, which describes the fact that authentication is disabled by default. This advisory describes an exploit chain that enables authentication bypass via the heartbeat refresh endpoint when authentication is enabled. Thi...

CVE-2025-69970

FUXA v1.2.7 contains an insecure default configuration vulnerability in server/settings.default.js. The 'secureEnabled' flag is commented out by default, causing the application to initialize with authentication disabled. This allows unauthenticated remote attackers to access sensitive API...

FUXA contains an insecure default configuration vulnerability

FUXA v1.2.7 contains an insecure default configuration vulnerability in server/settings.default.js. The 'secureEnabled' flag is commented out by default, causing the application to initialize with authentication disabled. This allows unauthenticated remote attackers to access sensitive API...

EUVD-2025-206711

FUXA v1.2.7 contains an insecure default configuration vulnerability in server/settings.default.js. The 'secureEnabled' flag is commented out by default, causing the application to initialize with authentication disabled. This allows unauthenticated remote attackers to access sensitive API...