/Vulnerability Library

FUXA <= 1.1.12 - Unauthenticated SQL Injection

CVE-2023-31719
Early Release

Description

FUXA <= 1.1.12 contains a SQL injection caused by unsanitized input in /api/signin, letting attackers execute arbitrary SQL commands, exploit requires sending crafted input to the endpoint.

Severity

Critical

CVSS Score

9.8

Affected Product

fuxa

Published Date

October 29, 2026

Template Author

securin

CVE-2023-31719.yaml
9.8Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2023-31719
CWE ID:
cwe-89

References

https://github.com/MateusTesser/CVE-2023-31719https://github.com/frangoteam/FUXA/blob/v1.1.12/server/runtime/users/usrstorage.jshttps://github.com/frangoteam/FUXA/blob/v1.1.12/server/api/auth/index.jshttps://nvd.nist.gov/vuln/detail/CVE-2023-31719

Remediation Steps

Update to the latest version of FUXA to fix the vulnerability.