HIGHnpm
GHSA-fwcm-rqvw-j3p7· CVE-2026-43946FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue
Modified: 5/26/2026
package
npm/fuxa-server
pkg:npm/fuxa-server
CRITICALnpm
GHSA-32cc-x95p-fxcg· CVE-2026-25894FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration
Modified: 2/10/2026
CRITICAL9.8npm
GHSA-5r63-q8hg-p8qx· CVE-2025-69983FUXA allows Remote Code Execution (RCE) via the project import functionality.
Modified: 2/11/2026
HIGHnpm
GHSA-68m5-5w2h-h837· CVE-2026-25951FUXA Affected by a Path Traversal Sanitization Bypass
Modified: 2/22/2026
HIGHnpm
GHSA-7g56-fwxj-cm23· CVE-2025-69981FUXA contains an Unrestricted File Upload vulnerability
Modified: 2/10/2026
CRITICALnpm
GHSA-88qh-cphv-996c· CVE-2026-25895FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API
Modified: 2/22/2026
MEDIUM6.3npm
GHSA-8ghr-w65f-j3qr· CVE-2026-47721FUXA's scheduler API missing admin check enables operator-to-admin escalation via scheduled device actions
Modified: 6/8/2026
CRITICALnpm
GHSA-c5gq-4h56-4mmx· CVE-2026-25751FUXA Unauthenticated Exposure of Plaintext Database Credentials
Modified: 2/6/2026
CRITICALnpm
GHSA-c869-jx4c-q5fc· CVE-2026-25939FUXA Unauthenticated Remote Arbitrary Scheduler Write
Modified: 2/10/2026
CRITICALnpm
GHSA-ggxw-g3cp-mgf8· CVE-2026-25752FUXA Unauthenticated Remote Arbitrary Device Tag Write
Modified: 2/6/2026
MEDIUM5.3npm
GHSA-h9fj-c2qr-76g2· CVE-2026-47720FUXA has SQL Injection in its TDengine DAQ connector via backslash bypass of escapeTdString
Modified: 6/8/2026
CRITICAL9.8npm
GHSA-p46g-8c3q-89p2· CVE-2023-31719FUXA SQL Injection vulnerability
Modified: 11/8/2023
HIGH7.5npm
GHSA-q3w6-q3hc-c5x6· CVE-2026-47717FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations
Modified: 5/27/2026
HIGHnpm
GHSA-r5m2-fqcf-qrf7· CVE-2025-69970FUXA contains an insecure default configuration vulnerability
Modified: 2/10/2026
MEDIUMnpm
GHSA-r9g5-7q8j-958c· CVE-2026-47718FUXA provides guest and invalid-token access to protected read APIs in secure mode
Modified: 5/28/2026
HIGHnpm
GHSA-rg3m-cfq7-g6h6· CVE-2026-43947FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass
Modified: 5/27/2026
CRITICALnpm
GHSA-v4p5-w6r3-2x4f· CVE-2026-25938FUXA Unauthenticated Remote Code Execution in Node-RED Integration
Modified: 2/10/2026
HIGH7.5npm
GHSA-v9q5-9crp-92f9· CVE-2023-31717FUXA SQL Injection vulnerability
Modified: 11/8/2023
CRITICALnpm
GHSA-vwcg-c828-9822· CVE-2026-25893FUXA Unauthenticated Remote Code Execution via Admin JWT Minting
Modified: 2/10/2026
HIGH8.2npm
GHSA-w86f-rf9w-h3x6· CVE-2026-47719FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading
Modified: 6/8/2026
HIGH7.5npm
GHSA-wwfj-h843-3hrq· CVE-2023-31718FUXA local file inclusion vulnerability
Modified: 11/8/2023