CVE-2025-69970

FUXA v1.2.7 contains an insecure default configuration vulnerability in server/settings.default.js. The 'secureEnabled' flag is commented out by default, causing the application to initialize with authentication disabled. This allows unauthenticated remote attackers to access sensitive API endpoints, modify projects, and control industrial equipment immediately after installation.

• CWE-1188

• https://github.com/frangoteam/FUXA/blob/master/server/settings.default.jsProduct

Published

Feb 3, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-69948SourceCodester Modern Loan Management System 1.0 is vulnerab…9.8
• CVE-2025-69949kishan0725 Hospital Management System 4.0 is vulnerable to S…7.3
• CVE-2025-6995Improper use of encryption in the agent of Ivanti Endpoint M…8.4
• CVE-2025-6996Improper use of encryption in the agent of Ivanti Endpoint M…8.4
• CVE-2025-69969A lack of authentication and authorization mechanisms in the…9.6
• CVE-2025-6997The ThemeREX Addons plugin for WordPress is vulnerable to St…5.4
• CVE-2025-69971FUXA v1.2.7 contains a hard-coded credential vulnerability i…9.8
• CVE-2025-6998ReDoS in strip_whitespaces() function in cps/string_helper.p…8.7
• CVE-2025-69981FUXA v1.2.7 contains an Unrestricted File Upload vulnerabili…9.8
• CVE-2025-69983FUXA v1.2.7 allows Remote Code Execution (RCE) via the proje…9.8
• CVE-2025-69985FUXA 1.2.8 and prior contains an Authentication Bypass vulne…9.8
• CVE-2025-69986A buffer overflow vulnerability exists in the ONVIF GetStrea…7.2