Priority HIGH 82
FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE).
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.06021 · Published 2026-02-24 · No fix listed CWE-288
Priority MEDIUM 57
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.
CVSS 4.0CRITICAL 9.5· Network · No auth · No interaction · EPSS 0.1285 · Published 2026-02-09 · Fixed in 1.2.10 CWE-22
Priority MEDIUM 44
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.
CVSS 4.0CRITICAL 9.5· Network · No auth · No interaction · EPSS 0.00842 · Published 2026-02-09 · Fixed in 1.2.10 CWE-1188
Priority MEDIUM 50
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.
CVSS 4.0CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.00758 · Published 2026-02-09 · Fixed in 1.2.10 CWE-285
Priority MEDIUM 42
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.
CVSS 4.0HIGH 8.6· Network · High privileges · No interaction · EPSS 0.01349 · Published 2026-02-09 · Fixed in 1.2.11 CWE-184
Priority MEDIUM 62
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.
CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.12536 · Published 2026-02-09 · Fixed in 1.2.11 CWE-862
Priority MEDIUM 51
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.
CVSS 4.0CRITICAL 9.5· Network · No auth · No interaction · EPSS 0.01057 · Published 2026-02-09 · Fixed in 1.2.11 CWE-290
Priority LOW 39
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.
CVSS 4.0CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00298 · Published 2026-02-06 · Fixed in 1.2.10 CWE-306
Priority MEDIUM 49
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.
CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.00531 · Published 2026-02-06 · Fixed in 1.2.10 CWE-862
Priority MEDIUM 49
FUXA v1.2.7 allows Remote Code Execution (RCE) via the project import functionality.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00499 · Published 2026-02-03 · No fix listed CWE-94
Priority MEDIUM 50
FUXA v1.2.7 contains an Unrestricted File Upload vulnerability in the `/api/upload` API endpoint.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00806 · Published 2026-02-03 · No fix listed CWE-434
Priority MEDIUM 53
FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02174 · Published 2026-02-03 · Fixed in 1.3.0 CWE-798
Priority MEDIUM 49
FUXA v1.2.7 contains an insecure default configuration vulnerability in server/settings.default.js.
CVSS 3.1CRITICAL 9.3· Network · No auth · User interaction · EPSS 0.00517 · Published 2026-02-03 · No fix listed CWE-1188
Priority HIGH 82
FUXA <= 1.1.12 is vulnerable to SQL Injection via /api/signin.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.44363 · Published 2023-09-21 · No fix listed CWE-89
Priority HIGH 72
FUXA <= 1.1.12 is vulnerable to Local via Inclusion via /api/download.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01734 · Published 2023-09-21 · No fix listed CWE-98
Priority HIGH 72
A SQL Injection attack in FUXA <= 1.1.12 allows exfiltration of confidential information from the database.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01835 · Published 2023-09-21 · No fix listed CWE-89
Priority MEDIUM 42
FUXA <= 1.1.12 has a Local File Inclusion vulnerability via file=fuxa.log
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01395 · Published 2023-09-21 · No fix listed CWE-98
Priority HIGH 82
A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.25951 · Published 2023-09-18 · No fix listed CWE-77
Priority LOW 36
A Server-Side Request Forgery (SSRF) attack in FUXA 1.1.3 can be carried out leading to the obtaining of sensitive information from the server's internal environment and services, often potentially leading to the attacke…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01454 · Published 2022-03-16 · No fix listed CWE-918
THREATIST.IORead the docs