CVE-2026-25751 json
FUXA Unauthenticated Exposure of Plaintext Database Credentials
published 2026-02-05 9 mo ago modified 2026-06-17 4 mo ago also GHSA-c5gq-4h56-4mmx , EUVD-2026-5619
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 22%
- public exploits
- 0
- none known
Summary
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An information disclosure vulnerability in FUXA allows an unauthenticated, remote attacker to retrieve sensitive administrative database credentials. Exploitation allows an unauthenticated, remote attacker to obtain the full system configuration, including administrative credentials for the InfluxDB database. Possession of these credentials may allow an attacker to authenticate directly to the database service, enabling them to read, modify, or delete all historical process data, or perform a Denial of Service by corrupting the database. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.
Patch / fix
- npm fuxa-server 1.2.10
- frangoteam fuxa 1.2.10
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 8 mo ago
Exploit prediction
0.30% chance of exploitation in the next 30 days, higher than 22% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.1 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H |
| CNA | 4.0 | 9.1 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | fuxa-server | <1.2.10 |
1.2.10 |
Affected products
- frangoteam FUXA
Classification
References
-
github.com
/frangoteam/FUXA/commit/c6c4cba1a62545e8e3ae0f43b2269e61209fbee8
web
-
github.com
/frangoteam/FUXA/security/advisories/GHSA-c5gq-4h56-4mmx
web, vendor-advisory
-
github.com
/frangoteam/FUXA/releases/tag/v1.2.10
web, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2026-25751
advisory
-
github.com
/frangoteam/FUXA
package
Sources
- CVE List CVE-2026-25751
- GitHub Advisory GHSA-c5gq-4h56-4mmx
- NVD CVE-2026-25751
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.