Frangoteam
Vulnerability activity for Frangoteam: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 3
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 3
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 16
- Critical (CVSS 9+)
- 12
- Exploited (CISA KEV)
- 0
- With exploit code
- 3
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 5.6MediumOct 29, 2026Frangoteam Auth bypass / access controlCVE-2026-42949A authorization bypass vulnerability exists in the /api/runscript functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to execute priviledged operation. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.
- 5.3MediumOct 29, 2026Frangoteam Information disclosureCVE-2026-40063A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to an information leak. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.
- 9.8CriticalOct 29, 2026Frangoteam Auth bypass / access controlCVE-2026-42922A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to a arbitrary code execution. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.
- 9.8CriticalFeb 24, 2026Frangoteam fuxa Auth bypass / access controlCVE-2025-69985FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE). The vulnerability exists in the server/api/jwt-helper.js middleware, which improperly trusts the HTTP "Referer" header to validate internal requests. A remote unauthenticated attacker can bypass JWT authentication by spoofing the Referer header to match the server's host. Successful exploitation allows the attacker to access the protected /api/runscript endpoint and execute arbitrary Node6% likelyExploit-DB
- 7.2HighFeb 9, 2026Frangoteam fuxa Path traversal / file handlingCVE-2026-25951FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.2.11, there is a flaw in the path sanitization logic allows an authenticated attacker with administrative privileges to bypass directory traversal protections. By using nested traversal sequences (e.g., ....//), an attacker can write arbitrary files to the server filesystem, including sensitive directories like runtime/scripts. This leads to Remote Code Execution (RCE) when the server reloads the malicious scrip1.4% likely
- 9.1CriticalFeb 9, 2026Frangoteam fuxa Auth bypass / access controlCVE-2026-25939FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through version 1.2.10, an authorization bypass vulnerability in the FUXA allows an unauthenticated, remote attacker to create and modify arbitrary schedulers, exposing connected ICS/SCADA environments to follow-on actions. This has been patched in FUXA version 1.2.11.13% likely
- 9.8CriticalFeb 9, 2026Frangoteam fuxa Auth bypass / access controlCVE-2026-25938FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through 1.2.10, an authentication bypass vulnerability in FUXA allows an unauthenticated, remote attacker to execute arbitrary code on the server when the Node-RED plugin is enabled. This has been patched in FUXA version 1.2.11.1.1% likely
- 9.8CriticalFeb 9, 2026Frangoteam fuxa Path traversal / file handlingCVE-2026-25895FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. A path traversal vulnerability in FUXA allows an unauthenticated, remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.13% likelyExploit-DB · NucleiDetection
- 9.8CriticalFeb 9, 2026Frangoteam fuxa Crypto / certificateCVE-2026-25894FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An insecure default configuration in FUXA allows an unauthenticated, remote attacker to gain administrative access and execute arbitrary code on the server. This affects FUXA through version 1.2.9 when authentication is enabled, but the administrator JWT secret is not configured. This issue has been patched in FUXA version 1.2.10.
- 9.8CriticalFeb 9, 2026Frangoteam fuxa Auth bypass / access controlCVE-2026-25893FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.2.10, an authentication bypass vulnerability in FUXA allows an unauthenticated, remote attacker to gain administrative access via the heartbeat refresh API and execute arbitrary code on the server. This issue has been patched in FUXA version 1.2.10.
- 9.1CriticalFeb 6, 2026Frangoteam fuxa Auth bypass / access controlCVE-2026-25752FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An authorization bypass vulnerability in FUXA allows an unauthenticated, remote attacker to modify device tags via WebSockets. Exploitation allows an unauthenticated, remote attacker to bypass role-based access controls and overwrite arbitrary device tags or disable communication drivers, exposing connected ICS/SCADA environments to follow-on actions. This may allow an attacker to manipulate physical processes and disconne
- 7.5HighFeb 6, 2026Frangoteam fuxa Auth bypass / access controlCVE-2026-25751FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An information disclosure vulnerability in FUXA allows an unauthenticated, remote attacker to retrieve sensitive administrative database credentials. Exploitation allows an unauthenticated, remote attacker to obtain the full system configuration, including administrative credentials for the InfluxDB database. Possession of these credentials may allow an attacker to authenticate directly to the database service, enabling th
- 9.8CriticalFeb 3, 2026Frangoteam fuxa Code / command injectionCVE-2025-69983FUXA v1.2.7 allows Remote Code Execution (RCE) via the project import functionality. The application does not properly sanitize or sandbox user-supplied scripts within imported project files. An attacker can upload a malicious project containing system commands, leading to full system compromise.
- 9.8CriticalFeb 3, 2026Frangoteam fuxa Path traversal / file handlingCVE-2025-69981FUXA v1.2.7 contains an Unrestricted File Upload vulnerability in the `/api/upload` API endpoint. The endpoint lacks authentication mechanisms, allowing unauthenticated remote attackers to upload arbitrary files. This can be exploited to overwrite critical system files (such as the SQLite user database) to gain administrative access, or to upload malicious scripts to execute arbitrary code.
- 9.8CriticalFeb 3, 2026Frangoteam fuxa Auth bypass / access controlCVE-2025-69971FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. The application uses a hard-coded secret key to sign and verify JWT Tokens. This allows remote attackers to forge valid admin tokens and bypass authentication to gain full administrative access.2.2% likelyNucleiDetection
- 9.3CriticalFeb 3, 2026Frangoteam fuxaCVE-2025-69970FUXA v1.2.7 contains an insecure default configuration vulnerability in server/settings.default.js. The 'secureEnabled' flag is commented out by default, causing the application to initialize with authentication disabled. This allows unauthenticated remote attackers to access sensitive API endpoints, modify projects, and control industrial equipment immediately after installation.
- 9.8CriticalSep 21, 2023Frangoteam fuxa SQL injectionCVE-2023-31719FUXA <= 1.1.12 is vulnerable to SQL Injection via /api/signin.26% likelyExploit codeNucleiDetection
Top products
- fuxa13 CVEs in the last year, 11 critical
- Frangoteam3 CVEs in the last year, 1 critical
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.