FFrangoteam

Products

Exploited and recent CVEs

• CVE-2026-42949 Medium 5.6 A authorization bypass vulnerability exists in the /api/runscript functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to execute priviledged operation. An attacke 0.2%
• CVE-2026-40063 Medium 5.3 A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to an information leak. An attacker 0.3%
• CVE-2026-42922 Critical 9.8 A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to a arbitrary code execution. An attacker can mak 0.5%
• CVE-2026-67442 Low 2.0 FUXA Business Logic Flaw: Role Deletion Without User Assignment Cleanup 0.3%
• CVE-2026-65984 High 7.5 FUXA: JWT lifecycle flaws allow deleted or demoted users to retain privileged sessions 0.5%
• CVE-2026-67443 Critical 9.2 FUXA: Unauthenticated guest JWT bypasses Node-RED secure-mode authorization gate (Remote Script Execution) 0.7%
• CVE-2026-65985 Medium 6.0 FUXA: SSRF hardening for `device-webapi-request` 0.5%
• CVE-2026-67440 Medium 6.9 FUXA: Unauthenticated Socket.IO read events 0.5%
• CVE-2026-47721 Medium 6.3 FUXA: Scheduler API missing admin check enables operator-to-admin escalation via scheduled device actions 0.4%
• CVE-2026-47719 High 8.2 FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading 0.6%
• CVE-2026-47720 Medium 5.3 FUXA: SQL injection in TDengine DAQ connector via backslash bypass of escapeTdString 0.6%
• CVE-2026-47718 Medium 5.5 FUXA provides guest and invalid-token access to protected read APIs in secure mode 0.5%
• CVE-2026-47717 High 7.5 FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations 1.4%
• CVE-2026-72586 High 7.5 frangoteam FUXA - Missing Authentication on DAQ_QUERY Socket.IO Event Handler 0.6%
• CVE-2026-43947 High 8.9 FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass 0.9%
• CVE-2026-43946 High 7.7 FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue 0.6%
• CVE-2026-43945 High 8.9 FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection 0.8%
• CVE-2026-13207 High 7.5 Frangoteam FUXA SCADA/HMI Authentication Bypass by Spoofing 0.6%
• CVE-2026-25895 Critical 9.5 FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API 12.8%
• CVE-2026-25894 Critical 9.5 FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration 0.8%
• CVE-2026-25893 Critical 10.0 FUXA Unauthenticated Remote Code Execution via Admin JWT Minting 0.8%
• CVE-2026-25951 High 8.6 FUXA has a Path Traversal Sanitization Bypass 1.4%
• CVE-2026-25939 Critical 9.3 FUXA Unauthenticated Remote Arbitrary Scheduler Write 12.5%
• CVE-2026-25938 Critical 9.5 FUXA Unauthenticated Remote Code Execution in Node-RED Integration 1.1%
• CVE-2026-25751 Critical 9.1 FUXA Unauthenticated Exposure of Plaintext Database Credentials 0.3%
• CVE-2026-25752 Critical 9.3 FUXA Unauthenticated Remote Arbitrary Device Tag Write 0.5%