{"kind": "product", "path": "vulns/npm/fuxa-server", "name": "fuxa-server", "product": "fuxa-server", "ecosystem": "npm", "items": [{"id": "CVE-2026-47721", "noindex": false, "published": "2026-08-18T20:00:19.405Z", "modified": "2026-08-19T15:21:35.696Z", "cvss": 6.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "severity": "medium", "epss": 0.00434, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-47721", "title": "FUXA: Scheduler API missing admin check enables operator-to-admin escalation via scheduled device actions", "description": "FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, POST /api/scheduler and DELETE /api/scheduler in server/api/scheduler/index.js do not consistently enforce authJwt.haveAdminPermission for scheduler settings. An authenticated non-admin operator can create or alter deviceActions that invoke onSetValue or onRunScript, or delete schedules, gaining access to device-value changes and server-side project script execution normally reserved for administrators. Scheduled and repeating actions can continue changing PLC setpoints, safety interlocks, device state, or project data after the operator's session ends. ", "references": ["https://github.com/frangoteam/FUXA/security/advisories/GHSA-8ghr-w65f-j3qr", "https://github.com/frangoteam/FUXA/pull/2345", "https://github.com/frangoteam/FUXA/commit/3c945a03f9942fd45a793ab7e3c2d1f1b15b93bf"], "fixes": [], "products": [{"name": "fuxa-server", "path": "vulns/npm/fuxa-server", "ecosystem": "npm"}]}, {"id": "CVE-2026-47719", "noindex": false, "published": "2026-08-18T19:59:28.851Z", "modified": "2026-08-21T19:07:25.133Z", "cvss": 8.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "severity": "high", "epss": 0.00592, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-47719", "title": "FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading", "description": "FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY Socket.IO handlers in server/runtime/index.js omit isSocketWriteAuthorized and accept attacker-controlled property.address or endpoint connection data. A remote unauthenticated attacker can make server/runtime/devices/httprequest/index.js call axios.get against arbitrary HTTP or HTTPS destinations, connect to reachable OPC UA or ODBC services, and receive results through the corresponding Socket.IO event. This read SSRF oracle can expose cloud instance metadata, internal administrative services, industrial en", "references": ["https://github.com/frangoteam/FUXA/security/advisories/GHSA-w86f-rf9w-h3x6", "https://github.com/frangoteam/FUXA/pull/2344", "https://github.com/frangoteam/FUXA/commit/7b2088eaae2be318d962dcba34bfc7a7f26837bd"], "fixes": [], "products": [{"name": "fuxa-server", "path": "vulns/npm/fuxa-server", "ecosystem": "npm"}]}, {"id": "CVE-2026-47720", "noindex": false, "published": "2026-08-18T19:58:26.111Z", "modified": "2026-08-19T13:10:57.660Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00641, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-47720", "title": "FUXA: SQL injection in TDengine DAQ connector via backslash bypass of escapeTdString", "description": "FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the TDengine DAQ storage connector's escapeTdString function in server/runtime/storage/tdengine/index.js doubles single quotes but does not escape backslashes. A remote unauthenticated attacker can submit a crafted sids tag identifier through GET /api/daq or the Socket.IO DAQ_QUERY event so TDengine interprets the backslash and quote sequence as SQL syntax. The injected query can return every row from fuxa.meters, exposing historical PLC tag values, device identifiers, and device names even when FUXA authentication is enabled. This issue is fixed in vers", "references": ["https://github.com/frangoteam/FUXA/security/advisories/GHSA-h9fj-c2qr-76g2", "https://github.com/frangoteam/FUXA/pull/2343", "https://github.com/frangoteam/FUXA/commit/b78f6159d02a56ce5ff48207feb936afb3534fc8"], "fixes": [], "products": [{"name": "fuxa-server", "path": "vulns/npm/fuxa-server", "ecosystem": "npm"}]}, {"id": "CVE-2026-47718", "noindex": false, "published": "2026-08-12T22:21:26.952Z", "modified": "2026-08-14T22:23:07.950Z", "cvss": 5.5, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P", "severity": "medium", "epss": 0.00458, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-47718", "title": "FUXA provides guest and invalid-token access to protected read APIs in secure mode", "description": "FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. When `secureEnabled=true`, FUXA `1.3.0-2773` still allows guest and invalid-token requests to read project, alarms, and scheduler APIs. Version 1.3.1 fixes this issue.", "references": ["https://github.com/frangoteam/FUXA/security/advisories/GHSA-r9g5-7q8j-958c", "https://github.com/frangoteam/FUXA/releases/tag/v1.3.1", "https://nvd.nist.gov/vuln/detail/CVE-2026-47718"], "fixes": ["1.3.1"], "products": [{"name": "fuxa-server", "path": "vulns/npm/fuxa-server", "ecosystem": "npm"}]}, {"id": "CVE-2026-47717", "noindex": false, "published": "2026-08-12T22:18:04.321Z", "modified": "2026-08-13T13:12:25.793Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "high", "epss": 0.01375, "kev": false, "exploits": ["nuclei"], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-47717", "title": "FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations", "description": "FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In fuxa-server version 1.3.0, the GET /api/project endpoint exposes sensitive project configuration data to guest-context requests even when secureEnabled is enabled. Version 1.3.1 fixes the issue.", "references": ["https://github.com/frangoteam/FUXA/security/advisories/GHSA-q3w6-q3hc-c5x6", "https://github.com/frangoteam/FUXA/releases/tag/v1.3.1", "https://nvd.nist.gov/vuln/detail/CVE-2026-47717"], "fixes": ["1.3.1"], "products": [{"name": "fuxa-server", "path": "vulns/npm/fuxa-server", "ecosystem": "npm"}]}, {"id": "CVE-2026-43947", "noindex": false, "published": "2026-07-21T21:33:09.631Z", "modified": "2026-07-23T13:57:18.426Z", "cvss": 8.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P", "severity": "high", "epss": 0.00911, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-43947", "title": "FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass", "description": "FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an unauthenticated Remote Code Execution vulnerability when `secureEnabled` is set to `true`. The `POST /api/runscript` endpoint checks authorization against the stored script's permission by ID, but when `test: true` is set in the request, it compiles and executes attacker-supplied code instead of the stored script's code. An unauthenticated attacker who knows a valid script ID and name may execute arbitrary code via test mode if at least one server-side script exists and is accessible without restrictive permissions. Script IDs and names can be obtai", "references": ["https://github.com/frangoteam/FUXA/security/advisories/GHSA-rg3m-cfq7-g6h6", "https://github.com/frangoteam/FUXA/pull/2260", "https://github.com/frangoteam/FUXA/commit/78534da61a91613712b44bb63c8d7da8c5df5ca4"], "fixes": ["1.3.1"], "products": [{"name": "fuxa-server", "path": "vulns/npm/fuxa-server", "ecosystem": "npm"}]}, {"id": "CVE-2026-43946", "noindex": false, "published": "2026-07-21T21:27:29.248Z", "modified": "2026-07-22T15:02:58.663Z", "cvss": 7.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P", "severity": "high", "epss": 0.00567, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-43946", "title": "FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue", "description": "FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an authorization bypass in the /api/getTagValue endpoint allows unauthenticated access to tag values when the referenced script does not exist. Version 1.3.1 patches the issue.", "references": ["https://github.com/frangoteam/FUXA/security/advisories/GHSA-fwcm-rqvw-j3p7", "https://github.com/frangoteam/FUXA/pull/2260", "https://github.com/frangoteam/FUXA/commit/78534da61a91613712b44bb63c8d7da8c5df5ca4"], "fixes": ["1.3.1"], "products": [{"name": "fuxa-server", "path": "vulns/npm/fuxa-server", "ecosystem": "npm"}]}, {"id": "CVE-2026-25895", "noindex": false, "published": "2026-02-09T22:29:48.203Z", "modified": "2026-02-11T21:24:49.202Z", "cvss": 9.5, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "severity": "critical", "epss": 0.13034, "kev": false, "exploits": ["exploitdb", "nuclei"], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-25895", "title": "FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API", "description": "FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. A path traversal vulnerability in FUXA allows an unauthenticated, remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.", "references": ["https://github.com/frangoteam/FUXA/security/advisories/GHSA-88qh-cphv-996c", "https://github.com/frangoteam/FUXA/commit/22c2192f5d9beef8a787c45eff3a14c24dbb5f96", "https://github.com/frangoteam/FUXA/releases/tag/v1.2.10"], "fixes": ["1.2.10"], "products": [{"name": "fuxa-server", "path": "vulns/npm/fuxa-server", "ecosystem": "npm"}]}, {"id": "CVE-2026-25894", "noindex": false, "published": "2026-02-09T22:28:46.316Z", "modified": "2026-02-11T21:25:17.858Z", "cvss": 9.5, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "severity": "critical", "epss": 0.00855, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-25894", "title": "FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration", "description": "FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An insecure default configuration in FUXA allows an unauthenticated, remote attacker to gain administrative access and execute arbitrary code on the server. This affects FUXA through version 1.2.9 when authentication is enabled, but the administrator JWT secret is not configured. This issue has been patched in FUXA version 1.2.10.", "references": ["https://github.com/frangoteam/FUXA/security/advisories/GHSA-32cc-x95p-fxcg", "https://github.com/frangoteam/FUXA/commit/ea7b3df066f9fdef8ecdce318398ae40546bc50d", "https://github.com/frangoteam/FUXA/releases/tag/v1.2.10"], "fixes": ["1.2.10"], "products": [{"name": "fuxa-server", "path": "vulns/npm/fuxa-server", "ecosystem": "npm"}]}, {"id": "CVE-2026-25893", "noindex": false, "published": "2026-02-09T22:26:45.351Z", "modified": "2026-02-11T21:25:42.412Z", "cvss": 10, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "severity": "critical", "epss": 0.00769, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-25893", "title": "FUXA Unauthenticated Remote Code Execution via Admin JWT Minting", "description": "FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.2.10, an authentication bypass vulnerability in FUXA allows an unauthenticated, remote attacker to gain administrative access via the heartbeat refresh API and execute arbitrary code on the server. This issue has been patched in FUXA version 1.2.10.", "references": ["https://github.com/frangoteam/FUXA/security/advisories/GHSA-vwcg-c828-9822", "https://github.com/frangoteam/FUXA/commit/fe82348d160904d0013b9a3e267d50158f5c7afb", "https://nvd.nist.gov/vuln/detail/CVE-2026-25893"], "fixes": ["1.2.10"], "products": [{"name": "fuxa-server", "path": "vulns/npm/fuxa-server", "ecosystem": "npm"}]}, {"id": "CVE-2026-25951", "noindex": false, "published": "2026-02-09T22:24:25.857Z", "modified": "2026-02-11T21:24:18.690Z", "cvss": 8.6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.01381, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-25951", "title": "FUXA has a Path Traversal Sanitization Bypass", "description": "FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.2.11, there is a flaw in the path sanitization logic allows an authenticated attacker with administrative privileges to bypass directory traversal protections. By using nested traversal sequences (e.g., ....//), an attacker can write arbitrary files to the server filesystem, including sensitive directories like runtime/scripts. This leads to Remote Code Execution (RCE) when the server reloads the malicious scripts. This vulnerability is fixed in 1.2.11.", "references": ["https://github.com/frangoteam/FUXA/security/advisories/GHSA-68m5-5w2h-h837", "https://github.com/frangoteam/FUXA/commit/f7a9f04b2ab97ab5421e4ec4e711c51e9f4b65c8", "https://github.com/frangoteam/FUXA/releases/tag/v1.2.11"], "fixes": ["1.2.11"], "products": [{"name": "fuxa-server", "path": "vulns/npm/fuxa-server", "ecosystem": "npm"}]}, {"id": "CVE-2026-25939", "noindex": false, "published": "2026-02-09T22:21:03.611Z", "modified": "2026-02-11T21:21:07.816Z", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H", "severity": "critical", "epss": 0.12716, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-25939", "title": "FUXA Unauthenticated Remote Arbitrary Scheduler Write", "description": "FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through version 1.2.10, \nan authorization bypass vulnerability in the FUXA allows an unauthenticated, remote attacker to create and modify arbitrary schedulers, exposing connected ICS/SCADA environments to follow-on actions. This has been patched in FUXA version 1.2.11.", "references": ["https://github.com/frangoteam/FUXA/security/advisories/GHSA-c869-jx4c-q5fc", "https://github.com/frangoteam/FUXA/commit/5782b35117a9bd14ffcb881f8dfb8c6680157d9b", "https://github.com/frangoteam/FUXA/releases/tag/v1.2.11"], "fixes": ["1.2.11"], "products": [{"name": "fuxa-server", "path": "vulns/npm/fuxa-server", "ecosystem": "npm"}]}, {"id": "CVE-2026-25938", "noindex": false, "published": "2026-02-09T22:18:15.774Z", "modified": "2026-02-11T21:22:19.452Z", "cvss": 9.5, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "severity": "critical", "epss": 0.01072, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-25938", "title": "FUXA Unauthenticated Remote Code Execution in Node-RED Integration", "description": "FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through 1.2.10, an authentication bypass vulnerability in FUXA allows an unauthenticated, remote attacker to execute arbitrary code on the server when the Node-RED plugin is enabled. This has been patched in FUXA version 1.2.11.", "references": ["https://github.com/frangoteam/FUXA/security/advisories/GHSA-v4p5-w6r3-2x4f", "https://github.com/frangoteam/FUXA/commit/5e7679b09718534e4501a146fdfe093da29af336", "https://github.com/frangoteam/FUXA/releases/tag/v1.2.11"], "fixes": ["1.2.11"], "products": [{"name": "fuxa-server", "path": "vulns/npm/fuxa-server", "ecosystem": "npm"}]}, {"id": "CVE-2026-25751", "noindex": false, "published": "2026-02-06T19:07:17.314Z", "modified": "2026-02-09T15:28:22.521Z", "cvss": 9.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H", "severity": "critical", "epss": 0.00302, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-25751", "title": "FUXA Unauthenticated Exposure of Plaintext Database Credentials", "description": "FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An information disclosure vulnerability in FUXA allows an unauthenticated, remote attacker to retrieve sensitive administrative database credentials. Exploitation allows an unauthenticated, remote attacker to obtain the full system configuration, including administrative credentials for the InfluxDB database. Possession of these credentials may allow an attacker to authenticate directly to the database service, enabling them to read, modify, or delete all historical process data, or perform a Denial of Service by corrupting the database. This affects FUXA through versio", "references": ["https://github.com/frangoteam/FUXA/security/advisories/GHSA-c5gq-4h56-4mmx", "https://github.com/frangoteam/FUXA/releases/tag/v1.2.10", "https://nvd.nist.gov/vuln/detail/CVE-2026-25751"], "fixes": ["1.2.10"], "products": [{"name": "fuxa-server", "path": "vulns/npm/fuxa-server", "ecosystem": "npm"}]}, {"id": "CVE-2026-25752", "noindex": false, "published": "2026-02-06T19:05:57.771Z", "modified": "2026-02-09T15:28:27.869Z", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H", "severity": "critical", "epss": 0.00539, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-25752", "title": "FUXA Unauthenticated Remote Arbitrary Device Tag Write", "description": "FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An authorization bypass vulnerability in FUXA allows an unauthenticated, remote attacker to modify device tags via WebSockets. Exploitation allows an unauthenticated, remote attacker to bypass role-based access controls and overwrite arbitrary device tags or disable communication drivers, exposing connected ICS/SCADA environments to follow-on actions. This may allow an attacker to manipulate physical processes and disconnected devices from the HMI. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.", "references": ["https://github.com/frangoteam/FUXA/security/advisories/GHSA-ggxw-g3cp-mgf8", "https://github.com/frangoteam/FUXA/releases/tag/v1.2.10", "https://nvd.nist.gov/vuln/detail/CVE-2026-25752"], "fixes": ["1.2.10"], "products": [{"name": "fuxa-server", "path": "vulns/npm/fuxa-server", "ecosystem": "npm"}]}, {"id": "CVE-2025-69983", "noindex": false, "published": "2026-02-03T00:00:00.000Z", "modified": "2026-02-11T17:10:17.573Z", "cvss": 8.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "severity": "high", "epss": 0.00499, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-69983", "title": "CVE-2025-69983", "description": "FUXA v1.2.7 allows Remote Code Execution (RCE) via the project import functionality. The application does not properly sanitize or sandbox user-supplied scripts within imported project files. An attacker can upload a malicious project containing system commands, leading to full system compromise.", "references": ["https://github.com/frangoteam/FUXA/blob/master/server/api/projects/index.js", "https://nvd.nist.gov/vuln/detail/CVE-2025-69983"], "fixes": [], "products": [{"name": "fuxa-server", "path": "vulns/npm/fuxa-server", "ecosystem": "npm"}]}, {"id": "CVE-2025-69981", "noindex": false, "published": "2026-02-03T00:00:00.000Z", "modified": "2026-02-11T17:08:25.986Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "high", "epss": 0.00806, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-69981", "title": "CVE-2025-69981", "description": "FUXA v1.2.7 contains an Unrestricted File Upload vulnerability in the `/api/upload` API endpoint. The endpoint lacks authentication mechanisms, allowing unauthenticated remote attackers to upload arbitrary files. This can be exploited to overwrite critical system files (such as the SQLite user database) to gain administrative access, or to upload malicious scripts to execute arbitrary code.", "references": ["https://github.com/frangoteam/FUXA/blob/master/server/api/projects/index.js#L193", "https://nvd.nist.gov/vuln/detail/CVE-2025-69981"], "fixes": [], "products": [{"name": "fuxa-server", "path": "vulns/npm/fuxa-server", "ecosystem": "npm"}]}, {"id": "CVE-2025-69970", "noindex": false, "published": "2026-02-03T00:00:00.000Z", "modified": "2026-02-09T21:45:58.274Z", "cvss": 9.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", "severity": "critical", "epss": 0.00517, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-69970", "title": "CVE-2025-69970", "description": "FUXA v1.2.7 contains an insecure default configuration vulnerability in server/settings.default.js. The 'secureEnabled' flag is commented out by default, causing the application to initialize with authentication disabled. This allows unauthenticated remote attackers to access sensitive API endpoints, modify projects, and control industrial equipment immediately after installation.", "references": ["https://github.com/frangoteam/FUXA/blob/master/server/settings.default.js", "https://nvd.nist.gov/vuln/detail/CVE-2025-69970"], "fixes": [], "products": [{"name": "fuxa-server", "path": "vulns/npm/fuxa-server", "ecosystem": "npm"}]}, {"id": "CVE-2023-31719", "noindex": false, "published": "2023-09-21T00:00:00.000Z", "modified": "2024-09-24T18:21:23.781Z", "cvss": 9.8, "cvss_vector": "", "severity": "critical", "epss": 0.44088, "kev": false, "exploits": ["nuclei"], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2023-31719", "title": "CVE-2023-31719", "description": "FUXA <= 1.1.12 is vulnerable to SQL Injection via /api/signin.", "references": ["https://github.com/frangoteam/FUXA", "https://youtu.be/cjb2KYpV6dY", "https://github.com/MateusTesser/CVE-2023-31719"], "fixes": [], "products": [{"name": "fuxa-server", "path": "vulns/npm/fuxa-server", "ecosystem": "npm"}]}, {"id": "CVE-2023-31718", "noindex": false, "published": "2023-09-21T00:00:00.000Z", "modified": "2024-09-24T18:24:33.157Z", "cvss": 7.5, "cvss_vector": "", "severity": "high", "epss": 0.01734, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2023-31718", "title": "CVE-2023-31718", "description": "FUXA <= 1.1.12 is vulnerable to Local via Inclusion via /api/download.", "references": ["https://github.com/frangoteam/FUXA", "https://youtu.be/VCQkEGntN04", "https://github.com/MateusTesser/CVE-2023-31718"], "fixes": [], "products": [{"name": "fuxa-server", "path": "vulns/npm/fuxa-server", "ecosystem": "npm"}]}], "total": 21, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 2, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "fuxa-server", "path": "vulns/npm/fuxa-server", "ecosystem": "npm"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-08-21T19:07:25.133Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}