CVE-2025-69981

FUXA v1.2.7 contains an Unrestricted File Upload vulnerability in the `/api/upload` API endpoint. The endpoint lacks authentication mechanisms, allowing unauthenticated remote attackers to upload arbitrary files. This can be exploited to overwrite critical system files (such as the SQLite user database) to gain administrative access, or to upload malicious scripts to execute arbitrary code.

• CWE-434
• CWE-434

• https://github.com/frangoteam/FUXA/blob/master/server/api/projects/index.js#L193Product

Published

Feb 3, 2026

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-6996Improper use of encryption in the agent of Ivanti Endpoint M…8.4
• CVE-2025-69969A lack of authentication and authorization mechanisms in the…9.6
• CVE-2025-6997The ThemeREX Addons plugin for WordPress is vulnerable to St…5.4
• CVE-2025-69970FUXA v1.2.7 contains an insecure default configuration vulne…9.3
• CVE-2025-69971FUXA v1.2.7 contains a hard-coded credential vulnerability i…9.8
• CVE-2025-6998ReDoS in strip_whitespaces() function in cps/string_helper.p…8.7
• CVE-2025-69983FUXA v1.2.7 allows Remote Code Execution (RCE) via the proje…9.8
• CVE-2025-69985FUXA 1.2.8 and prior contains an Authentication Bypass vulne…9.8
• CVE-2025-69986A buffer overflow vulnerability exists in the ONVIF GetStrea…7.2
• CVE-2025-69988BS Producten Petcam 33.1.0.0818 is vulnerable to Incorrect A…6.5
• CVE-2025-6999An HTTP Request Smuggling [CWE-444] vulnerability in the Aut…6.9
• CVE-2025-69990phpgurukul News Portal Project V4.1 has an Arbitrary File De…9.1