https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-69985.htmlhttps://patchthecve.com/cve/CVE-2025-69985.htmlWed, 17 Jun 2026 10:00:56 +0000CRITICAL 9.8: FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE). The vulnerability exists in the server/api/jwt-helper.js middleware, which improperly trusts the HTTP "Referer" header to validate internal requests. A remote unauthenticated attacker can byphttps://patchthecve.com/cve/CVE-2026-25752.htmlhttps://patchthecve.com/cve/CVE-2026-25752.htmlWed, 17 Jun 2026 10:25:10 +0000CRITICAL 9.1: FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An authorization bypass vulnerability in FUXA allows an unauthenticated, remote attacker to modify device tags via WebSockets. Exploitation allows an unauthenticated, remote attacker to bypass role-based access controls and ovhttps://patchthecve.com/cve/CVE-2026-25751.htmlhttps://patchthecve.com/cve/CVE-2026-25751.htmlWed, 17 Jun 2026 10:25:10 +0000HIGH 7.5: FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An information disclosure vulnerability in FUXA allows an unauthenticated, remote attacker to retrieve sensitive administrative database credentials. Exploitation allows an unauthenticated, remote attacker to obtain the full shttps://patchthecve.com/cve/CVE-2025-69983.htmlhttps://patchthecve.com/cve/CVE-2025-69983.htmlWed, 17 Jun 2026 10:00:56 +0000CRITICAL 9.8: FUXA v1.2.7 allows Remote Code Execution (RCE) via the project import functionality. The application does not properly sanitize or sandbox user-supplied scripts within imported project files. An attacker can upload a malicious project containing system commands, leading to full system compromise.https://patchthecve.com/cve/CVE-2025-69981.htmlhttps://patchthecve.com/cve/CVE-2025-69981.htmlWed, 17 Jun 2026 10:00:56 +0000CRITICAL 9.8: FUXA v1.2.7 contains an Unrestricted File Upload vulnerability in the `/api/upload` API endpoint. The endpoint lacks authentication mechanisms, allowing unauthenticated remote attackers to upload arbitrary files. This can be exploited to overwrite critical system files (such as the SQLite user databhttps://patchthecve.com/cve/CVE-2025-69971.htmlhttps://patchthecve.com/cve/CVE-2025-69971.htmlWed, 17 Jun 2026 10:00:56 +0000CRITICAL 9.8: FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. The application uses a hard-coded secret key to sign and verify JWT Tokens. This allows remote attackers to forge valid admin tokens and bypass authentication to gain full administrative access.https://patchthecve.com/cve/CVE-2025-69970.htmlhttps://patchthecve.com/cve/CVE-2025-69970.htmlWed, 17 Jun 2026 10:00:56 +0000CRITICAL 9.3: FUXA v1.2.7 contains an insecure default configuration vulnerability in server/settings.default.js. The 'secureEnabled' flag is commented out by default, causing the application to initialize with authentication disabled. This allows unauthenticated remote attackers to access sensitive API endpoints