Skip to contentFrangoteam Fuxa vulnerabilities
- frangoteam fuxaFUXA Business Logic Flaw: Role Deletion Without User Assignment CleanupCVE-2026-674422.0 Low
- frangoteam fuxaFUXA: JWT lifecycle flaws allow deleted or demoted users to retain privileged sessionsCVE-2026-659847.5 High
- frangoteam fuxaFUXA: Unauthenticated guest JWT bypasses Node-RED secure-mode authorization gate (Remote Script Execution)CVE-2026-674439.2 Critical
- frangoteam fuxaFUXA: SSRF hardening for `device-webapi-request`CVE-2026-659856.0 Medium
- frangoteam fuxaFUXA: Unauthenticated Socket.IO read eventsCVE-2026-674406.9 Medium
- frangoteam fuxafrangoteam FUXA - Missing Authentication on DAQ_QUERY Socket.IO Event HandlerCVE-2026-725867.5 High
- frangoteam fuxa scada/hmiFrangoteam FUXA SCADA/HMI Authentication Bypass by SpoofingCVE-2026-132078.7 High
- frangoteam fuxaFUXA: Scheduler API missing admin check enables operator-to-admin escalation via scheduled device actionsCVE-2026-477216.3 Medium
- frangoteam fuxaFUXA: SQL injection in TDengine DAQ connector via backslash bypass of escapeTdStringCVE-2026-477205.3 Medium
- frangoteam fuxaFUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response readingCVE-2026-477198.2 High
- frangoteam fuxaFUXA provides guest and invalid-token access to protected read APIs in secure modeCVE-2026-47718Fix available5.5 Medium
- frangoteam fuxaFUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device ConfigurationsCVE-2026-47717Fix available7.5 High
- frangoteam fuxaFUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization BypassCVE-2026-43947Fix available8.9 High
- frangoteam fuxaFUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValueCVE-2026-43946Fix available7.7 High
- frangoteam fuxaFUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration InjectionCVE-2026-43945Fix available8.9 High
- frangoteam fuxaFUXA has JWT Authentication Bypass via HTTP Referer header spoofingCVE-2025-69985Public exploit9.8 Critical
- frangoteam fuxaFUXA has a Path Traversal Sanitization BypassCVE-2026-25951Fix available8.6 High
- frangoteam fuxaFUXA Unauthenticated Remote Arbitrary Scheduler WriteCVE-2026-25939Public exploitFix availableEPSS 24.3%9.3 Critical
- frangoteam fuxaFUXA Unauthenticated Remote Code Execution in Node-RED IntegrationCVE-2026-25938Public exploitFix available9.5 Critical
- frangoteam fuxaFUXA Unauthenticated Remote Arbitrary Device Tag WriteCVE-2026-25752Fix available9.3 Critical
- frangoteam fuxaFUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload APICVE-2026-25895Public exploitFix availableEPSS 12.8%9.5 Critical
- frangoteam fuxaFUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default ConfigurationCVE-2026-25894Fix available9.5 Critical
- frangoteam fuxaFUXA Unauthenticated Exposure of Plaintext Database CredentialsCVE-2026-25751Fix available9.1 Critical
- frangoteam fuxaFUXA Unauthenticated Remote Code Execution via Admin JWT MintingCVE-2026-25893Fix available10.0 Critical
- frangoteam fuxaFUXA allows Remote Code Execution (RCE) via the project import functionality.CVE-2025-699839.8 Critical
- frangoteam fuxaFUXA contains an Unrestricted File Upload vulnerabilityCVE-2025-699819.8 Critical
- frangoteam fuxaDuplicate Advisory: FUXA contains a hard-coded credential vulnerabilityCVE-2025-69971Fix available9.8 Critical
- frangoteam fuxaFUXA contains an insecure default configuration vulnerabilityCVE-2025-699709.3 Critical
- frangoteam fuxaFUXA SQL Injection vulnerabilityCVE-2023-31719Public exploitEPSS 44.4%9.8 Critical
- frangoteam fuxaFUXA local file inclusion vulnerabilityCVE-2023-31718Public exploit7.5 High
- frangoteam fuxaFUXA SQL Injection vulnerabilityCVE-2023-31717Public exploit7.5 High
- frangoteam fuxaFUXA vulnerable to Local File InclusionCVE-2023-31716Public exploit7.5 High
- frangoteam fuxaA remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXACVE-2023-33831Public exploitEPSS 26.0%9.8 Critical
- frangoteam fuxaServer-Side Request Forgery in FUXACVE-2021-458517.5 High