Frangoteam vulnerabilities
26 CVEs and advisories name Frangoteam as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-42949A authorization bypass vulnerability exists in the /api/runscript functionality of FUXA (version(s): 1.3.2-2809).
- CVE-2026-40063A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version(s): 1.3.2-2809).
- CVE-2026-42922A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809).
- CVE-2026-67442FUXA Business Logic Flaw: Role Deletion Without User Assignment Cleanup
- CVE-2026-65984FUXA: JWT lifecycle flaws allow deleted or demoted users to retain privileged sessions
- CVE-2026-67443FUXA: Unauthenticated guest JWT bypasses Node-RED secure-mode authorization gate (Remote Script Execution)
- CVE-2026-65985FUXA: SSRF hardening for `device-webapi-request`
- CVE-2026-67440FUXA: Unauthenticated Socket.IO read events
- CVE-2026-47721FUXA: Scheduler API missing admin check enables operator-to-admin escalation via scheduled device actions
- CVE-2026-47719FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading
- CVE-2026-47720FUXA: SQL injection in TDengine DAQ connector via backslash bypass of escapeTdString
- CVE-2026-47718FUXA provides guest and invalid-token access to protected read APIs in secure mode
- CVE-2026-47717FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations
- CVE-2026-72586frangoteam FUXA - Missing Authentication on DAQ_QUERY Socket.IO Event Handler
- CVE-2026-43947FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass
- CVE-2026-43946FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue
- CVE-2026-43945FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection
- CVE-2026-13207Frangoteam FUXA SCADA/HMI Authentication Bypass by Spoofing
- CVE-2026-25895FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API
- CVE-2026-25894FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration
- CVE-2026-25893FUXA Unauthenticated Remote Code Execution via Admin JWT Minting
- CVE-2026-25951FUXA has a Path Traversal Sanitization Bypass
- CVE-2026-25939FUXA Unauthenticated Remote Arbitrary Scheduler Write
- CVE-2026-25938FUXA Unauthenticated Remote Code Execution in Node-RED Integration
- CVE-2026-25751FUXA Unauthenticated Exposure of Plaintext Database Credentials
- CVE-2026-25752FUXA Unauthenticated Remote Arbitrary Device Tag Write