CVE-2025-69983

Katalog CVE

CVSS 9.8 · Critical EPSS 0,48%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada frangoteam fuxa. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

FUXA v1.2.7 allows Remote Code Execution (RCE) via the project import functionality. The application does not properly sanitize or sandbox user-supplied scripts within imported project files. An attacker can upload a malicious project containing system commands, leading to full system compromise.

Rincian

Terbit di NVD

3 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

0,48% peluang dieksploitasi; lebih tinggi dari 39,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/frangoteam/FUXA/blob/master/server/api/projects/index.js product