CVE-2026-47720

The record

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the TDengine DAQ storage connector's escapeTdString function in server/runtime/storage/tdengine/index.js doubles single quotes but does not escape backslashes. A remote unauthenticated attacker can submit a crafted sids tag identifier through GET /api/daq or the Socket.IO DAQ_QUERY event so TDengine interprets the backslash and quote sequence as SQL syntax. The injected query can return every row from fuxa.meters, exposing historical PLC tag values, device identifiers, and device names even when FUXA authentication is enabled. This issue is fixed in version 1.3.2.

Affected packages

Related vulnerabilities

• GHSA-h9fj-c2qr-76g2 FUXA has SQL Injection in its TDengine DAQ connector via backslash bypass of… Same vulnerability
• CVE-2026-47719 FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Also affects fuxa-server
• CVE-2026-47721 FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Also affects fuxa-server
• GHSA-8ghr-w65f-j3qr FUXA's scheduler API missing admin check enables operator-to-admin escalation via… Also affects fuxa-server
• GHSA-w86f-rf9w-h3x6 FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with… Also affects fuxa-server
• GHSA-r9g5-7q8j-958c FUXA provides guest and invalid-token access to protected read APIs in secure mode Also affects fuxa-server
• CVE-2026-47718 FUXA provides guest and invalid-token access to protected read APIs in secure mode Also affects fuxa-server
• GHSA-q3w6-q3hc-c5x6 FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device… Also affects fuxa-server