FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE)

FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API

FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration

FUXA Unauthenticated Remote Code Execution via Admin JWT Minting

FUXA Unauthenticated Remote Code Execution in Node-RED Integration

FUXA v1.2.7 contains an Unrestricted File Upload vulnerability in the `/api/upload` API endpoint

FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js

FUXA v1.2.7 allows Remote Code Execution (RCE) via the project import functionality

FUXA <= 1.1.12 is vulnerable to SQL Injection via /api/signin

A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request

FUXA v1.2.7 contains an insecure default configuration vulnerability in server/settings.default.js

FUXA: Unauthenticated guest JWT bypasses Node-RED secure-mode authorization gate (Remote Script Execution)

FUXA Unauthenticated Remote Arbitrary Scheduler Write

FUXA Unauthenticated Remote Arbitrary Device Tag Write

FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass

FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection

FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading

FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue

FUXA: JWT lifecycle flaws allow deleted or demoted users to retain privileged sessions

FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations

frangoteam FUXA - Missing Authentication on DAQ_QUERY Socket.IO Event Handler

FUXA Unauthenticated Exposure of Plaintext Database Credentials

FUXA <= 1.1.12 is vulnerable to Local via Inclusion via /api/download

A SQL Injection attack in FUXA <= 1.1.12 allows exfiltration of confidential information from the database

FUXA <= 1.1.12 has a Local File Inclusion vulnerability via file=fuxa.log

A Server-Side Request Forgery (SSRF) attack in FUXA 1.1.3 can be carried out leading to the obtaining of sensitive information from the server's internal environment and services,…

FUXA has a Path Traversal Sanitization Bypass

FUXA: Unauthenticated Socket.IO read events

FUXA: Scheduler API missing admin check enables operator-to-admin escalation via scheduled device actions

FUXA: SSRF hardening for `device-webapi-request`

FUXA provides guest and invalid-token access to protected read APIs in secure mode

FUXA: SQL injection in TDengine DAQ connector via backslash bypass of escapeTdString

FUXA Business Logic Flaw: Role Deletion Without User Assignment Cleanup