A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA

Description

A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request.

Recommendation

No fix is available yet. Followings are affected versions:

<= 1.1.13

References

GHSA-r87q-fq37-pvr6
youtu.be
CVE-2023-33831
CWE-77
CWE-94
CAPEC-310
OWASP 2021-A3
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA and gives you actionable findings to investigate.

Start a free scan

Related Issues

JSONPath Plus Remote Code Execution (RCE) Vulnerability - CVE-2024-21534
MCP Connect has unauthenticated remote OS command execution via /bridge endpoint - Vulnerability
Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability - CVE-2026-41265
FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection - CVE-2026-43945

CSRF, XXE, and 12 Other Security Acronyms Explained

Exploiting Server Version Disclosure

How do hackers hack websites?

See something that needs correcting? Let us knowUpdated November 11, 2023