Skip to main content
cve.nowby Sazabi
← npm
npmPackage

fuxa-server

21 known vulnerabilities (8 critical, 7 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release
1.1.14-1243 (Jul 10, 2023): affected by 12 advisories
Newest unaffected release
Every release is affected by at least one advisory
Advisories
21 · 8 critical, 7 high, 3 medium
Weekly downloads
39
Dependents
0
Releases
1 since 1.1.14-1243 (Jul 10, 2023)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Show all 21 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 21

  • CVE-2026-47721Medium 6.3

    FUXA: Scheduler API missing admin check enables operator-to-admin escalation via scheduled device actions

    Affected: through 1.1.14-1243.

    No fix released. The latest release, 1.1.14-1243, is still affected.

    100% of fuxa-server downloads last week were affected versions (27).

  • FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading

    Affected: through 1.1.14-1243.

    No fix released. The latest release, 1.1.14-1243, is still affected.

    100% of fuxa-server downloads last week were affected versions (27).

  • CVE-2026-47720Medium 5.3

    FUXA: SQL injection in TDengine DAQ connector via backslash bypass of escapeTdString

    Affected: through 1.1.14-1243.

    No fix released. The latest release, 1.1.14-1243, is still affected.

    100% of fuxa-server downloads last week were affected versions (27).

  • CVE-2026-47718Medium 5.5

    FUXA provides guest and invalid-token access to protected read APIs in secure mode

    Affected: from 1.3.0-2773, fixed in 1.3.1.

    No fix released. The advisory names 1.3.1 as the fix, which the registry doesn't have yet.

    0% of fuxa-server downloads last week were affected versions (0).

  • FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations

    Affected: from 1.3.0, fixed in 1.3.1.

    No fix released. The advisory names 1.3.1 as the fix, which the registry doesn't have yet.

    0% of fuxa-server downloads last week were affected versions (0).

  • FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass

    Affected: from 1.3.0, fixed in 1.3.1.

    No fix released. The advisory names 1.3.1 as the fix, which the registry doesn't have yet.

    0% of fuxa-server downloads last week were affected versions (0).

  • FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue

    Affected: from 1.3.0, fixed in 1.3.1.

    No fix released. The advisory names 1.3.1 as the fix, which the registry doesn't have yet.

    0% of fuxa-server downloads last week were affected versions (0).

  • CVE-2026-25895Critical 9.5

    FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API

    Affected: fixed in 1.2.10.

    No fix released. The advisory names 1.2.10 as the fix, which the registry doesn't have yet. The latest release, 1.1.14-1243, is still affected.

    100% of fuxa-server downloads last week were affected versions (27).

  • CVE-2026-25894Critical 9.5

    FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration

    Affected: fixed in 1.2.10.

    No fix released. The advisory names 1.2.10 as the fix, which the registry doesn't have yet. The latest release, 1.1.14-1243, is still affected.

    100% of fuxa-server downloads last week were affected versions (27).

  • CVE-2026-25893Critical 10.0

    FUXA Unauthenticated Remote Code Execution via Admin JWT Minting

    Affected: fixed in 1.2.10.

    No fix released. The advisory names 1.2.10 as the fix, which the registry doesn't have yet. The latest release, 1.1.14-1243, is still affected.

    100% of fuxa-server downloads last week were affected versions (27).

  • FUXA has a Path Traversal Sanitization Bypass

    Affected: fixed in 1.2.11.

    No fix released. The advisory names 1.2.11 as the fix, which the registry doesn't have yet. The latest release, 1.1.14-1243, is still affected.

    100% of fuxa-server downloads last week were affected versions (27).

  • CVE-2026-25939Critical 9.3

    FUXA Unauthenticated Remote Arbitrary Scheduler Write

    Affected: from 1.2.8, fixed in 1.2.11.

    No fix released. The advisory names 1.2.11 as the fix, which the registry doesn't have yet.

    0% of fuxa-server downloads last week were affected versions (0).

  • CVE-2026-25938Critical 9.5

    FUXA Unauthenticated Remote Code Execution in Node-RED Integration

    Affected: from 1.2.8, fixed in 1.2.11.

    No fix released. The advisory names 1.2.11 as the fix, which the registry doesn't have yet.

    0% of fuxa-server downloads last week were affected versions (0).

  • CVE-2026-25751Critical 9.1

    FUXA Unauthenticated Exposure of Plaintext Database Credentials

    Affected: fixed in 1.2.10.

    No fix released. The advisory names 1.2.10 as the fix, which the registry doesn't have yet. The latest release, 1.1.14-1243, is still affected.

    100% of fuxa-server downloads last week were affected versions (27).

  • CVE-2026-25752Critical 9.3

    FUXA Unauthenticated Remote Arbitrary Device Tag Write

    Affected: fixed in 1.2.10.

    No fix released. The advisory names 1.2.10 as the fix, which the registry doesn't have yet. The latest release, 1.1.14-1243, is still affected.

    100% of fuxa-server downloads last week were affected versions (27).

Show all 21 advisoriesShow fewer advisories

  • FUXA v1.2.7 allows Remote Code Execution (RCE) via the project import functionality.

    Affected: through 1.2.7.

    No fix released. The latest release, 1.1.14-1243, is still affected.

    100% of fuxa-server downloads last week were affected versions (27).

  • FUXA v1.2.7 contains an Unrestricted File Upload vulnerability in the `/api/upload` API endpoint.

    Affected: through 1.2.7.

    No fix released. The latest release, 1.1.14-1243, is still affected.

    100% of fuxa-server downloads last week were affected versions (27).

  • CVE-2025-69970Critical 9.3

    FUXA v1.2.7 contains an insecure default configuration vulnerability in server/settings.default.js.

    Affected: through 1.2.7.

    No fix released. The latest release, 1.1.14-1243, is still affected.

    100% of fuxa-server downloads last week were affected versions (27).

  • FUXA <= 1.1.12 is vulnerable to SQL Injection via /api/signin.

    Affected: through 1.1.12.

    No fix released.

    0% of fuxa-server downloads last week were affected versions (0).

  • FUXA <= 1.1.12 is vulnerable to Local via Inclusion via /api/download.

    Affected: through 1.1.12.

    No fix released.

    0% of fuxa-server downloads last week were affected versions (0).

  • A SQL Injection attack in FUXA <= 1.1.12 allows exfiltration of confidential information from the database.

    Affected: through 1.1.12.

    No fix released.

    0% of fuxa-server downloads last week were affected versions (0).