{"schema_version":1,"title":"fuxa-server (npm) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 24 vulnerabilities in fuxa-server (npm): 0 in the last 7 days and 5 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-47721, was published on 18 August 2026.","url":"https://junglewise.ai/threats/technologies/fuxa-server","json_url":"https://junglewise.ai/threats/technologies/fuxa-server.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/fuxa-server","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":6,"all_time":24,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":5,"last_365_days":21},"latest":[{"cve":"CVE-2026-47721","cvss":6.3,"epss":0.0043,"slug":"cve-2026-47721-frangoteam-fuxa-privilege-escalation-in-scheduler-api","title":"FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, POST /api/scheduler and DELETE /api/scheduler in s","severity":"medium","exploited":false,"published_at":"2026-08-18T20:17:15.383+00:00","url":"https://junglewise.ai/threats/cve-2026-47721-frangoteam-fuxa-privilege-escalation-in-scheduler-api"},{"cve":"CVE-2026-47720","cvss":5.3,"epss":0.0064,"slug":"cve-2026-47720-frangoteam-fuxa-sql-injection-in-tdengine-daq-connector","title":"FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the TDengine DAQ storage connector's escapeTdStrin","severity":"medium","exploited":false,"published_at":"2026-08-18T20:17:15.25+00:00","url":"https://junglewise.ai/threats/cve-2026-47720-frangoteam-fuxa-sql-injection-in-tdengine-daq-connector"},{"cve":"CVE-2026-47719","cvss":8.2,"epss":0.0059,"slug":"cve-2026-47719-frangoteam-fuxa-unauthenticated-ssrf-in-socket-io-handlers","title":"FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY Sock","severity":"high","exploited":false,"published_at":"2026-08-18T20:17:15.103+00:00","url":"https://junglewise.ai/threats/cve-2026-47719-frangoteam-fuxa-unauthenticated-ssrf-in-socket-io-handlers"},{"cve":"CVE-2026-43947","cvss":4,"epss":0.0091,"slug":"cve-2026-43947-frangoteam-fuxa-unauthenticated-rce-in-api-runscript","title":"frangoteam FUXA unauthenticated RCE in /api/runscript","severity":"high","exploited":false,"published_at":"2026-07-21T22:17:01.56+00:00","url":"https://junglewise.ai/threats/cve-2026-43947-frangoteam-fuxa-unauthenticated-rce-in-api-runscript"},{"cve":"CVE-2026-43946","cvss":4,"epss":0.0057,"slug":"cve-2026-43946-frangoteam-fuxa-authorization-bypass-in-api-gettagvalue","title":"frangoteam FUXA authorization bypass in /api/getTagValue","severity":"high","exploited":false,"published_at":"2026-07-21T22:17:01.41+00:00","url":"https://junglewise.ai/threats/cve-2026-43946-frangoteam-fuxa-authorization-bypass-in-api-gettagvalue"},{"cve":"CVE-2026-47718","cvss":4,"epss":0.0046,"slug":"cve-2026-47718-frangoteam-fuxa-authentication-bypass-in-protected-read-apis","title":"frangoteam FUXA authentication bypass in protected read APIs","severity":"medium","exploited":false,"published_at":"2026-05-28T20:33:11+00:00","url":"https://junglewise.ai/threats/cve-2026-47718-frangoteam-fuxa-authentication-bypass-in-protected-read-apis"},{"cve":"CVE-2026-47717","cvss":7.5,"epss":0.0138,"slug":"cve-2026-47717-fuxa-unauthenticated-project-data-disclosure-in-api","title":"FUXA unauthenticated project data disclosure in API","severity":"high","exploited":false,"published_at":"2026-05-27T22:51:18+00:00","url":"https://junglewise.ai/threats/cve-2026-47717-fuxa-unauthenticated-project-data-disclosure-in-api"},{"cve":"CVE-2025-69971","cvss":8.1,"epss":0.0208,"slug":"cve-2025-69971-frangoteam-fuxa-hardcoded-jwt-signing-secret-fallback","title":"frangoteam FUXA hardcoded JWT signing secret fallback","severity":"high","exploited":false,"published_at":"2026-03-07T02:31:18+00:00","url":"https://junglewise.ai/threats/cve-2025-69971-frangoteam-fuxa-hardcoded-jwt-signing-secret-fallback"},{"cve":"CVE-2026-25951","cvss":4,"epss":0.0173,"slug":"cve-2026-25951-fuxa-path-traversal-sanitization-bypass","title":"FUXA path traversal sanitization bypass","severity":"medium","exploited":false,"published_at":"2026-02-10T00:29:00+00:00","url":"https://junglewise.ai/threats/cve-2026-25951-fuxa-path-traversal-sanitization-bypass"},{"cve":"CVE-2026-25939","cvss":4,"epss":0.0084,"slug":"cve-2026-25939-fuxa-authorization-bypass-in-scheduler-endpoint","title":"FUXA authorization bypass in scheduler endpoint","severity":"medium","exploited":false,"published_at":"2026-02-10T00:28:28+00:00","url":"https://junglewise.ai/threats/cve-2026-25939-fuxa-authorization-bypass-in-scheduler-endpoint"},{"cve":"CVE-2026-25938","cvss":4,"epss":0.0133,"slug":"cve-2026-25938-fuxa-authentication-bypass-in-node-red-integration","title":"FUXA authentication bypass in Node-RED integration","severity":"medium","exploited":false,"published_at":"2026-02-10T00:27:31+00:00","url":"https://junglewise.ai/threats/cve-2026-25938-fuxa-authentication-bypass-in-node-red-integration"},{"cve":"CVE-2026-25752","cvss":4,"epss":0.0066,"slug":"cve-2026-25752-fuxa-unauthenticated-remote-arbitrary-device-tag-write","title":"FUXA unauthenticated remote arbitrary device tag write","severity":"medium","exploited":false,"published_at":"2026-02-05T00:38:25+00:00","url":"https://junglewise.ai/threats/cve-2026-25752-fuxa-unauthenticated-remote-arbitrary-device-tag-write"},{"cve":"CVE-2026-25895","cvss":4,"epss":0.0621,"slug":"cve-2026-25895-fuxa-path-traversal-arbitrary-file-write-in-upload-api","title":"FUXA path traversal arbitrary file write in upload API","severity":"medium","exploited":false,"published_at":"2026-02-05T00:37:30+00:00","url":"https://junglewise.ai/threats/cve-2026-25895-fuxa-path-traversal-arbitrary-file-write-in-upload-api"},{"cve":"CVE-2026-25894","cvss":4,"epss":0.0124,"slug":"cve-2026-25894-frangoteam-fuxa-remote-code-execution-via-hardcoded-jwt-secret","title":"FUXA unauthenticated remote code execution via hardcoded JWT secret","severity":"medium","exploited":false,"published_at":"2026-02-05T00:36:30+00:00","url":"https://junglewise.ai/threats/cve-2026-25894-frangoteam-fuxa-remote-code-execution-via-hardcoded-jwt-secret"},{"cve":"CVE-2026-25751","cvss":4,"epss":0.0037,"slug":"cve-2026-25751-fuxa-unauthenticated-exposure-of-plaintext-database-credentials","title":"FUXA unauthenticated exposure of plaintext database credentials","severity":"medium","exploited":false,"published_at":"2026-02-05T00:33:44+00:00","url":"https://junglewise.ai/threats/cve-2026-25751-fuxa-unauthenticated-exposure-of-plaintext-database-credentials"},{"cve":"CVE-2026-25893","cvss":4,"epss":0.0108,"slug":"cve-2026-25893-fuxa-authentication-bypass-and-remote-code-execution-via","title":"FUXA authentication bypass and remote code execution via heartbeat refresh API","severity":"medium","exploited":false,"published_at":"2026-02-05T00:27:53+00:00","url":"https://junglewise.ai/threats/cve-2026-25893-fuxa-authentication-bypass-and-remote-code-execution-via"},{"cve":"CVE-2025-69983","cvss":3.1,"epss":0.0044,"slug":"cve-2025-69983-fuxa-remote-code-execution-in-project-import","title":"FUXA remote code execution in project import","severity":"low","exploited":false,"published_at":"2026-02-03T18:30:47+00:00","url":"https://junglewise.ai/threats/cve-2025-69983-fuxa-remote-code-execution-in-project-import"},{"cve":"CVE-2025-69970","cvss":4,"epss":0.0048,"slug":"cve-2025-69970-fuxa-insecure-default-authentication-configuration","title":"FUXA insecure default authentication configuration","severity":"medium","exploited":false,"published_at":"2026-02-03T18:30:47+00:00","url":"https://junglewise.ai/threats/cve-2025-69970-fuxa-insecure-default-authentication-configuration"},{"cvss":4,"slug":"fuxa-hard-coded-jwt-secret-key-1946cce6","title":"FUXA hard-coded JWT secret key","severity":"medium","exploited":false,"published_at":"2026-02-03T18:30:47+00:00","url":"https://junglewise.ai/threats/fuxa-hard-coded-jwt-secret-key-1946cce6"},{"cve":"CVE-2025-69981","cvss":4,"epss":0.0077,"slug":"cve-2025-69981-fuxa-unrestricted-file-upload-in-api-endpoint","title":"FUXA unrestricted file upload in API endpoint","severity":"medium","exploited":false,"published_at":"2026-02-03T18:30:47+00:00","url":"https://junglewise.ai/threats/cve-2025-69981-fuxa-unrestricted-file-upload-in-api-endpoint"},{"cvss":9.8,"slug":"frangoteam-fuxa-hard-coded-secret-in-jwt-authentication-88d907ce","title":"frangoteam FUXA hard-coded secret in JWT authentication","severity":"high","exploited":false,"published_at":"2026-02-03T18:30:47+00:00","url":"https://junglewise.ai/threats/frangoteam-fuxa-hard-coded-secret-in-jwt-authentication-88d907ce"},{"cve":"CVE-2023-31719","cvss":3.1,"epss":0.2603,"slug":"cve-2023-31719-fuxa-sql-injection-in-sign-in-endpoint","title":"FUXA SQL injection in sign-in endpoint","severity":"low","exploited":false,"published_at":"2023-09-22T00:30:29+00:00","url":"https://junglewise.ai/threats/cve-2023-31719-fuxa-sql-injection-in-sign-in-endpoint"},{"cve":"CVE-2023-31717","cvss":3.1,"epss":0.0182,"slug":"cve-2023-31717-fuxa-sql-injection-in-http-post-parameter","title":"FUXA SQL injection in HTTP POST parameter","severity":"low","exploited":false,"published_at":"2023-09-22T00:30:29+00:00","url":"https://junglewise.ai/threats/cve-2023-31717-fuxa-sql-injection-in-http-post-parameter"},{"cve":"CVE-2023-31718","cvss":3.1,"epss":0.0173,"slug":"cve-2023-31718-fuxa-local-file-inclusion-in-download-endpoint","title":"FUXA local file inclusion in download endpoint","severity":"low","exploited":false,"published_at":"2023-09-22T00:30:29+00:00","url":"https://junglewise.ai/threats/cve-2023-31718-fuxa-local-file-inclusion-in-download-endpoint"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":3},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"flowise (npm)","slug":"flowise","vulnerabilities":156,"url":"https://junglewise.ai/threats/technologies/flowise"},{"name":"vm2 (npm)","slug":"vm2","vulnerabilities":82,"url":"https://junglewise.ai/threats/technologies/vm2"},{"name":"@budibase/server (npm)","slug":"budibase-server","vulnerabilities":61,"url":"https://junglewise.ai/threats/technologies/budibase-server"},{"name":"directus (npm)","slug":"directus","vulnerabilities":60,"url":"https://junglewise.ai/threats/technologies/directus"},{"name":"nocodb (npm)","slug":"nocodb","vulnerabilities":55,"url":"https://junglewise.ai/threats/technologies/nocodb"},{"name":"hono (npm)","slug":"hono","vulnerabilities":54,"url":"https://junglewise.ai/threats/technologies/hono"},{"name":"parse-server (npm)","slug":"parse-server","vulnerabilities":42,"url":"https://junglewise.ai/threats/technologies/parse-server"},{"name":"dompurify (npm)","slug":"dompurify","vulnerabilities":39,"url":"https://junglewise.ai/threats/technologies/dompurify"},{"name":"ghost (npm)","slug":"ghost","vulnerabilities":39,"url":"https://junglewise.ai/threats/technologies/ghost"},{"name":"flowise-components (npm)","slug":"flowise-components","vulnerabilities":35,"url":"https://junglewise.ai/threats/technologies/flowise-components"},{"name":"astro (npm)","slug":"astro","vulnerabilities":30,"url":"https://junglewise.ai/threats/technologies/astro"},{"name":"@anthropic-ai/claude-code (npm)","slug":"anthropic-ai-claude-code","vulnerabilities":28,"url":"https://junglewise.ai/threats/technologies/anthropic-ai-claude-code"}],"technology":{"hub":true,"name":"fuxa-server (npm)","slug":"fuxa-server","vendor":{"name":"npm","slug":"npm","url":"https://junglewise.ai/threats/vendors/npm"},"aliases":[],"homepage":"https://frangoteam.org/","repo_url":"https://github.com/frangoteam/FUXA","description":"A web-based SCADA/HMI platform for industrial automation.","url":"https://junglewise.ai/threats/technologies/fuxa-server"},"most_severe":[{"cvss":9.8,"slug":"frangoteam-fuxa-hard-coded-secret-in-jwt-authentication-88d907ce","title":"frangoteam FUXA hard-coded secret in JWT authentication","severity":"high","exploited":false,"published_at":"2026-02-03T18:30:47+00:00","url":"https://junglewise.ai/threats/frangoteam-fuxa-hard-coded-secret-in-jwt-authentication-88d907ce"},{"cve":"CVE-2026-47719","cvss":8.2,"epss":0.0059,"slug":"cve-2026-47719-frangoteam-fuxa-unauthenticated-ssrf-in-socket-io-handlers","title":"FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY Sock","severity":"high","exploited":false,"published_at":"2026-08-18T20:17:15.103+00:00","url":"https://junglewise.ai/threats/cve-2026-47719-frangoteam-fuxa-unauthenticated-ssrf-in-socket-io-handlers"},{"cve":"CVE-2025-69971","cvss":8.1,"epss":0.0208,"slug":"cve-2025-69971-frangoteam-fuxa-hardcoded-jwt-signing-secret-fallback","title":"frangoteam FUXA hardcoded JWT signing secret fallback","severity":"high","exploited":false,"published_at":"2026-03-07T02:31:18+00:00","url":"https://junglewise.ai/threats/cve-2025-69971-frangoteam-fuxa-hardcoded-jwt-signing-secret-fallback"},{"cve":"CVE-2026-47717","cvss":7.5,"epss":0.0138,"slug":"cve-2026-47717-fuxa-unauthenticated-project-data-disclosure-in-api","title":"FUXA unauthenticated project data disclosure in API","severity":"high","exploited":false,"published_at":"2026-05-27T22:51:18+00:00","url":"https://junglewise.ai/threats/cve-2026-47717-fuxa-unauthenticated-project-data-disclosure-in-api"},{"cve":"CVE-2026-43947","cvss":4,"epss":0.0091,"slug":"cve-2026-43947-frangoteam-fuxa-unauthenticated-rce-in-api-runscript","title":"frangoteam FUXA unauthenticated RCE in /api/runscript","severity":"high","exploited":false,"published_at":"2026-07-21T22:17:01.56+00:00","url":"https://junglewise.ai/threats/cve-2026-43947-frangoteam-fuxa-unauthenticated-rce-in-api-runscript"},{"cve":"CVE-2026-43946","cvss":4,"epss":0.0057,"slug":"cve-2026-43946-frangoteam-fuxa-authorization-bypass-in-api-gettagvalue","title":"frangoteam FUXA authorization bypass in /api/getTagValue","severity":"high","exploited":false,"published_at":"2026-07-21T22:17:01.41+00:00","url":"https://junglewise.ai/threats/cve-2026-43946-frangoteam-fuxa-authorization-bypass-in-api-gettagvalue"},{"cve":"CVE-2026-47721","cvss":6.3,"epss":0.0043,"slug":"cve-2026-47721-frangoteam-fuxa-privilege-escalation-in-scheduler-api","title":"FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, POST /api/scheduler and DELETE /api/scheduler in s","severity":"medium","exploited":false,"published_at":"2026-08-18T20:17:15.383+00:00","url":"https://junglewise.ai/threats/cve-2026-47721-frangoteam-fuxa-privilege-escalation-in-scheduler-api"},{"cve":"CVE-2026-47720","cvss":5.3,"epss":0.0064,"slug":"cve-2026-47720-frangoteam-fuxa-sql-injection-in-tdengine-daq-connector","title":"FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the TDengine DAQ storage connector's escapeTdStrin","severity":"medium","exploited":false,"published_at":"2026-08-18T20:17:15.25+00:00","url":"https://junglewise.ai/threats/cve-2026-47720-frangoteam-fuxa-sql-injection-in-tdengine-daq-connector"},{"cve":"CVE-2026-25895","cvss":4,"epss":0.0621,"slug":"cve-2026-25895-fuxa-path-traversal-arbitrary-file-write-in-upload-api","title":"FUXA path traversal arbitrary file write in upload API","severity":"medium","exploited":false,"published_at":"2026-02-05T00:37:30+00:00","url":"https://junglewise.ai/threats/cve-2026-25895-fuxa-path-traversal-arbitrary-file-write-in-upload-api"},{"cve":"CVE-2026-25951","cvss":4,"epss":0.0173,"slug":"cve-2026-25951-fuxa-path-traversal-sanitization-bypass","title":"FUXA path traversal sanitization bypass","severity":"medium","exploited":false,"published_at":"2026-02-10T00:29:00+00:00","url":"https://junglewise.ai/threats/cve-2026-25951-fuxa-path-traversal-sanitization-bypass"}],"generated_at":"2026-09-26T10:14:00.201383+00:00"}