CVE-2026-67442 is an improper access control vulnerability in frangoteam's FUXA web-based Process Visualization software. Versions prior to 1.3.3 have an issue where deleting a role does not fully remove the role identifier from users' role arrays or runtime caches. This can cause users to retain permissions that administrators intended to revoke, leading to residual privileges and inconsistent access control states. The issue is fixed in version 1.3.3.
FUXA versions 1.3.2 and earlier suffer from insufficient session expiration, allowing attackers with previously issued privileged refresh cookies or access tokens to continue minting privileged JWTs even after account deletion or role changes. This enables unauthorized persistent access to sensitive functions such as user management and backdoor account creation. The vulnerability is fixed in version 1.3.3.
FUXA versions 1.3.2 and earlier contain a missing authorization vulnerability in the Node-RED integration. An unauthenticated remote attacker can obtain a signed guest token and access the Node-RED HTTP admin editor and flow deployment API without proper identity verification. This allows the attacker to deploy function nodes or invoke scripts, potentially gaining control over project data, configuration, scripts, and runtime helpers, including operating system commands if unsafe modules are enabled. The issue is fixed in version 1.3.3.
CVE-2026-65985 is a Server-Side Request Forgery (SSRF) vulnerability in frangoteam's FUXA software, versions 1.3.2 and earlier. It allows an authenticated non-admin runtime user to manipulate the device-webapi-request handler to make the server issue arbitrary HTTP or HTTPS requests. The vulnerability is fixed in version 1.3.3.
FUXA versions 1.3.2 and earlier have a missing authorization vulnerability in certain Socket.IO event handlers that allow unauthenticated or guest users to access device and network metadata. This issue does not expose normal device status or alarm data but reveals system-discovery information beyond what is intended for public viewing. The vulnerability is fixed in version 1.3.3.
FUXA versions prior to 1.3.2 have a missing authorization vulnerability in the scheduler API endpoints. Authenticated non-admin users can create, modify, or delete scheduled device actions that normally require admin permissions. This allows unauthorized changes to device values and execution of server-side scripts, potentially affecting PLC setpoints, safety interlocks, and project data even after the user's session ends. The issue is fixed in version 1.3.2.
CVE-2026-47719 is a Server-Side Request Forgery (SSRF) vulnerability in frangoteam's FUXA software, a web-based SCADA/HMI/Dashboard tool. Versions prior to 1.3.2 allow unauthenticated remote attackers to make the server perform HTTP(S) requests to arbitrary destinations by exploiting insufficient authorization checks in Socket.IO handlers. This can expose sensitive internal resources such as cloud metadata, administrative services, industrial endpoints, and ODBC data accessible from the FUXA host. The vulnerability is fixed in version 1.3.2.
CVE-2026-47720 is a SQL injection vulnerability in FUXA, a web-based SCADA/HMI/Dashboard software. Versions prior to 1.3.2 have an issue in the TDengine DAQ storage connector where backslashes are not properly escaped in SQL queries. This allows a remote unauthenticated attacker to inject SQL via crafted requests, potentially exposing historical PLC tag values, device identifiers, and device names. The vulnerability is fixed in version 1.3.2.
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. When `secureEnabled=true`, FUXA `1.3.0-2773` still allows guest and invalid-token requests to read project, alarms, and scheduler APIs. Version 1.3.1 fixes this issue.
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In fuxa-server version 1.3.0, the GET /api/project endpoint exposes sensitive project configuration data to guest-context requests even when secureEnabled is enabled. Version 1.3.1 fixes the issue.
FUXA version 1.3.0 contains an unauthenticated remote code execution vulnerability in the POST /api/runscript endpoint when secureEnabled is true. An attacker can exploit the test mode feature to execute arbitrary code by supplying a valid script ID and name. This occurs because the endpoint executes attacker-supplied code instead of the stored script's code when test: true is set. The vulnerability is fixed in version 1.3.1.
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an authorization bypass in the /api/getTagValue endpoint allows unauthenticated access to tag values when the referenced script does not exist. Version 1.3.1 patches the issue.
FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE). The vulnerability exists in the server/api/jwt-helper.js middleware, which improperly trusts the HTTP "Referer" header to validate internal requests. A remote unauthenticated attacker can bypass JWT authentication by spoofing the Referer header to match the server's host. Successful exploitation allows the attacker to access the protected /api/runscript endpoint and execute arbitrary Node.js code on the server.
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An information disclosure vulnerability in FUXA allows an unauthenticated, remote attacker to retrieve sensitive administrative database credentials. Exploitation allows an unauthenticated, remote attacker to obtain the full system configuration, including administrative credentials for the InfluxDB database. Possession of these credentials may allow an attacker to authenticate directly to the database service, enabling them to read, modify, or delete all historical process data, or perform a Denial of Service by corrupting the database. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An authorization bypass vulnerability in FUXA allows an unauthenticated, remote attacker to modify device tags via WebSockets. Exploitation allows an unauthenticated, remote attacker to bypass role-based access controls and overwrite arbitrary device tags or disable communication drivers, exposing connected ICS/SCADA environments to follow-on actions. This may allow an attacker to manipulate physical processes and disconnected devices from the HMI. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.
FUXA v1.2.7 allows Remote Code Execution (RCE) via the project import functionality. The application does not properly sanitize or sandbox user-supplied scripts within imported project files. An attacker can upload a malicious project containing system commands, leading to full system compromise.
FUXA v1.2.7 contains an Unrestricted File Upload vulnerability in the `/api/upload` API endpoint. The endpoint lacks authentication mechanisms, allowing unauthenticated remote attackers to upload arbitrary files. This can be exploited to overwrite critical system files (such as the SQLite user database) to gain administrative access, or to upload malicious scripts to execute arbitrary code.
FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. The application uses a hard-coded secret key to sign and verify JWT Tokens. This allows remote attackers to forge valid admin tokens and bypass authentication to gain full administrative access.
FUXA v1.2.7 contains an insecure default configuration vulnerability in server/settings.default.js. The 'secureEnabled' flag is commented out by default, causing the application to initialize with authentication disabled. This allows unauthenticated remote attackers to access sensitive API endpoints, modify projects, and control industrial equipment immediately after installation.