20
CVEs
13
Critical
7
High
0
KEV
7
PoC
10
Unpatched C/H
50.0%
Patch Rate
2.6%
Avg EPSS
Severity Breakdown
CRITICAL
13
HIGH
7
MEDIUM
0
LOW
0
Monthly CVE Trend
Affected Products (5)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2025-69971 | FUXA v1.2.7 has hard-coded JWT credentials (EPSS 4.8%) that allow attackers to forge authentication tokens and bypass all access controls on the SCADA interface. | CRITICAL | 9.8 | 4.8% | 74 |
PoC
|
| CVE-2025-69985 | Authentication bypass in FUXA SCADA/HMI system 1.2.8 and prior leading to Remote Code Execution. Unauthenticated attackers can execute arbitrary code on industrial control HMI systems. EPSS 0.64% with PoC available. | CRITICAL | 9.8 | 0.6% | 70 |
PoC
No patch
|
| CVE-2026-25895 | FUXA SCADA has a path traversal vulnerability — ninth critical vulnerability enabling arbitrary file access on SCADA servers. | CRITICAL | 9.8 | 0.0% | 69 |
PoC
|
| CVE-2023-33831 | A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 13.7% | 69 |
PoC
No patch
|
| CVE-2023-31719 | FUXA <= 1.1.12 is vulnerable to SQL Injection via /api/signin. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 27.4% | 69 |
PoC
No patch
|
| CVE-2023-31717 | A SQL Injection attack in FUXA <= 1.1.12 allows exfiltration of confidential information from the database. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.5 | 1.6% | 58 |
PoC
No patch
|
| CVE-2023-31718 | FUXA <= 1.1.12 is vulnerable to Local via Inclusion via /api/download. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.5 | 1.5% | 58 |
PoC
No patch
|
| CVE-2026-13207 | Authentication bypass in FUXA SCADA/HMI versions 1.3.1 and prior lets remote unauthenticated attackers reach protected REST API endpoints by inserting dot-segment sequences (e.g. /api/./users, /api/project/../users) that the router fails to normalize before applying its authentication middleware. Successful exploitation returns sensitive user and role data without any credentials. No public exploit identified at time of analysis, though the technique is trivially reproducible and the issue is documented in a CISA ICS advisory (ICSA-26-181-02). | HIGH | 8.7 | 0.4% | 54 |
No patch
|
| CVE-2025-69983 | FUXA v1.2.7 allows remote code execution through the project import functionality by importing crafted project files containing malicious code. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2026-25893 | FUXA SCADA has yet another authorization bypass — now the seventh critical FUXA vulnerability discovered, enabling unauthenticated access to industrial controls. | CRITICAL | 9.8 | 0.1% | 49 |
|
| CVE-2026-25938 | FUXA SCADA has an authentication spoofing vulnerability from versions 1.2.8 through 1.2.10 — tenth critical vulnerability. | CRITICAL | 9.8 | 0.1% | 49 |
|
| CVE-2026-25894 | FUXA SCADA has insecure default configuration with a known JWT secret — eighth critical vulnerability. | CRITICAL | 9.8 | 0.1% | 49 |
|
| CVE-2025-69981 | FUXA v1.2.7 has an unrestricted file upload in the /api/upload endpoint that lacks authentication and file type validation, enabling web shell deployment on SCADA systems. | CRITICAL | 9.8 | 0.0% | 49 |
No patch
|
| CVE-2025-69970 | FUXA v1.2.7 SCADA/HMI system has insecure default configuration with security disabled by default, exposing industrial control interfaces without authentication. | CRITICAL | 9.3 | 0.1% | 47 |
No patch
|
| CVE-2026-25752 | FUXA SCADA/HMI software has an additional authorization bypass vulnerability enabling unauthenticated access to industrial control visualizations. | CRITICAL | 9.1 | 0.0% | 46 |
|