Approved changes feed: RSS · Atom
cpe:2.3:a:frangoteam:fuxa:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Frangoteam (0c7c5449-617d-5f69-beee-0b5507015091) |
|---|---|
| Product | Fuxa (0c61af47-3976-5611-81cb-a4ca33812b9a) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/bilalimrani/fuxa |
purl2cpe | 2026-06-01 10:14:35.317043 |
pkg:github/frangoteam/fuxa |
purl2cpe | 2026-06-01 10:14:35.317045 |
pkg:npm/%40frangoteam/fuxa |
purl2cpe | 2026-06-01 10:14:35.317046 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-47717 |
vulnerable | 2026-09-16 04:34:01.498171 |
FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations
HIGH (7.5)
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In fuxa-server version 1.3.0, the GET /api/project endpoint exposes sensitive project configuration data to guest-context requests even when secureEnabled is enabled. Version 1.3.1 fixes the issue.
Published: 2026-08-12T22:18:04.321Z
Updated: 2026-08-13T13:12:25.793Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-47718 |
vulnerable | 2026-09-16 04:34:01.096996 |
FUXA provides guest and invalid-token access to protected read APIs in secure mode
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. When `secureEnabled=true`, FUXA `1.3.0-2773` still allows guest and invalid-token requests to read project, alarms, and scheduler APIs. Version 1.3.1 fixes this issue.
Published: 2026-08-12T22:21:26.952Z
Updated: 2026-08-14T22:23:07.950Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-72586 |
vulnerable | 2026-09-16 04:33:09.243138 |
frangoteam FUXA - Missing Authentication on DAQ_QUERY Socket.IO Event Handler
HIGH (7.5)
A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DAQ_QUERY Socket.IO event. When secureEnabled=true, all other sensitive Socket.IO events (DEVICE_BROWSE, HOST_INTERFACES, DEVICE_TAGS_REQUEST, etc.) call isSocketAdminAuthorized to verify the connection token, but the DAQ_QUERY handler in server/runtime/index.js lacks this check entirely.
Published: 2026-08-10T10:41:33.196Z
Updated: 2026-08-10T13:20:56.197Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-43946 |
vulnerable | 2026-07-29 00:52:13.962464 |
FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an authorization bypass in the /api/getTagValue endpoint allows unauthenticated access to tag values when the referenced script does not exist. Version 1.3.1 patches the issue.
Published: 2026-07-21T21:27:29.248Z
Updated: 2026-07-22T15:02:58.663Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-43945 |
vulnerable | 2026-07-29 00:52:13.962126 |
FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Versions 1.2.11 until 1.3.1 allow an unauthenticated remote attacker to achieve Full Remote Code Execution (RCE) as root. The exploit succeeds even when the platform is configured in its most secure state (Secure Mode Enabled and Node-RED Secure Auth Enabled). Version 1.3.1 fixes the issue.
Published: 2026-07-21T21:24:59.259Z
Updated: 2026-07-22T18:24:33.883Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-25951 |
vulnerable | 2026-06-08 07:53:20.636162 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-25939 |
vulnerable | 2026-06-08 07:53:20.627985 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-25938 |
vulnerable | 2026-06-08 07:53:20.627724 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-25895 |
vulnerable | 2026-06-08 07:53:20.587458 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-25894 |
vulnerable | 2026-06-08 07:53:20.587172 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-25893 |
vulnerable | 2026-06-08 07:53:20.586760 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-25752 |
vulnerable | 2026-06-08 07:53:20.291162 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-25751 |
vulnerable | 2026-06-08 07:53:20.290831 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-69985 |
vulnerable | 2026-06-08 07:43:13.927130 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-31719 |
vulnerable | 2026-06-08 06:04:43.459170 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-31718 |
vulnerable | 2026-06-08 06:04:43.458730 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-31717 |
vulnerable | 2026-06-08 06:04:43.458362 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-31716 |
vulnerable | 2026-06-08 06:04:43.457787 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.