Unauthenticated-RCE-FUXA-CVE-2023-33831

RCE sin autenticación FUXA CVE-2023-33831 La vulnerabilidad afecta al componente de scripting de FUXA, debido a la falta de control o saneamiento en las entradas que pueden ser controladas por los usuarios, permitiendo así el uso de métodos peligrosos que pueden escalar a ejecución remota de...

CVE-2026-43947: Incorrect Authorization

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Version 1.3.0 has an unauthenticated Remote Code Execution vulnerability when secureEnabled is set to true. The POST /api/runscript endpoint checks authorization against the stored script's permission by ID, but when test: tr...

📄 FUX 1.2.8 Authentication Bypass / Remote Command Execution

This Python exploit targets CVE-2025-69985, an authentication bypass in FUXA web-based SCADA/HMI software that allows access to the protected /api/runscript endpoint even when authentication is enabled. By sending a crafted JavaScript payload using childprocess.execSync, it achieves full remote...

CVE-2023-33831

A remote command execution RCE vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request...

CVE-2023-33831: Improper Neutralization of Special Elements used in a Command

A remote command execution RCE vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request...