GCVE - cpe:2.3:a:frangoteam:fuxa:1.2.7:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:frangoteam:fuxa:1.2.7:*:*:*:*:*:*:*

part: a version: 1.2.7 update: *

Vendor	Frangoteam (`0c7c5449-617d-5f69-beee-0b5507015091`)
Product	Fuxa (`0c61af47-3976-5611-81cb-a4ca33812b9a`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/bilalimrani/fuxa`	purl2cpe	2026-06-01 10:14:35.317206
`pkg:github/frangoteam/fuxa`	purl2cpe	2026-06-01 10:14:35.317207
`pkg:npm/%40frangoteam/fuxa`	purl2cpe	2026-06-01 10:14:35.317209

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-69983`	vulnerable	2026-06-08 07:43:13.923546	Details available FUXA v1.2.7 allows Remote Code Execution (RCE) via the project import functionality. The application does not properly sanitize or sandbox user-supplied scripts within imported project files. An attacker can upload a malicious project containing system commands, leading to full system compromise. Published: 2026-02-03T00:00:00.000Z Updated: 2026-02-11T17:10:17.573Z Open on db.gcve.eu Reference links https://github.com/frangoteam/FUXA/blob/master/server/api/projects/index.js	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-69981`	vulnerable	2026-06-08 07:43:13.923082	Details available FUXA v1.2.7 contains an Unrestricted File Upload vulnerability in the `/api/upload` API endpoint. The endpoint lacks authentication mechanisms, allowing unauthenticated remote attackers to upload arbitrary files. This can be exploited to overwrite critical system files (such as the SQLite user database) to gain administrative access, or to upload malicious scripts to execute arbitrary code. Published: 2026-02-03T00:00:00.000Z Updated: 2026-02-11T17:08:25.986Z Open on db.gcve.eu Reference links https://github.com/frangoteam/FUXA/blob/master/server/api/projects/index.js#L193	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-69971`	vulnerable	2026-06-08 07:43:13.922708	Details available FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. The application uses a hard-coded secret key to sign and verify JWT Tokens. This allows remote attackers to forge valid admin tokens and bypass authentication to gain full administrative access. Published: 2026-02-03T00:00:00.000Z Updated: 2026-02-28T02:59:59.337Z Open on db.gcve.eu Reference links https://github.com/frangoteam/FUXA/blob/master/server/api/jwt-helper.js	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-69970`	vulnerable	2026-06-08 07:43:13.922232	Details available FUXA v1.2.7 contains an insecure default configuration vulnerability in server/settings.default.js. The 'secureEnabled' flag is commented out by default, causing the application to initialize with authentication disabled. This allows unauthenticated remote attackers to access sensitive API endpoints, modify projects, and control industrial equipment immediately after installation. Published: 2026-02-03T00:00:00.000Z Updated: 2026-02-09T21:45:58.274Z Open on db.gcve.eu Reference links https://github.com/frangoteam/FUXA/blob/master/server/settings.default.js	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.