CVE-2026-47720— FUXA: SQL injection in TDengine DAQ connector via backslash bypass of escapeTdString
Quick assessment
Affected
frangoteam FUXA
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
frangoteam FUXA是frangoteam组织开源的一款工业控制软件。 frangoteam FUXA 1.3.2之前版本存在SQL注入漏洞，该漏洞源于TDengine DAQ存储连接器的escapeTdString函数仅对单引号进行加倍而未转义反斜杠，导致远程未认证攻击者可通过GET /api/daq或Socket.IO DAQ_QUERY事件提交特制的sids标签标识符，造成SQL注入，从而暴露历史PLC标签值、设备标识符和设备名称。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| frangoteam | FUXA | < 1.3.2 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-47720
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
FUXA: SQL injection in TDengine DAQ connector via backslash bypass of escapeTdString
Source: CVE Program / CVE List V5
Vulnerability Description
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the TDengine DAQ storage connector's escapeTdString function in server/runtime/storage/tdengine/index.js doubles single quotes but does not escape backslashes. A remote unauthenticated attacker can submit a crafted sids tag identifier through GET /api/daq or the Socket.IO DAQ_QUERY event so TDengine interprets the backslash and quote sequence as SQL syntax. The injected query can return every row from fuxa.meters, exposing historical PLC tag values, device identifiers, and device names even when FUXA authentication is enabled. This issue is fixed in version 1.3.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Vulnerability Title
frangoteam FUXA SQL注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
frangoteam FUXA是frangoteam组织开源的一款工业控制软件。 frangoteam FUXA 1.3.2之前版本存在SQL注入漏洞，该漏洞源于TDengine DAQ存储连接器的escapeTdString函数仅对单引号进行加倍而未转义反斜杠，导致远程未认证攻击者可通过GET /api/daq或Socket.IO DAQ_QUERY事件提交特制的sids标签标识符，造成SQL注入，从而暴露历史PLC标签值、设备标识符和设备名称。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| frangoteam | FUXA | < 1.3.2 | - |
|
II. Public POCs for CVE-2026-47720
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-47720
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-47720 (2)
Vendor Advisories for CVE-2026-47720 (1)
Vendor Pages for CVE-2026-47720 (1)
-
🔗 Release v1.3.2 · frangoteam/FUXA · GitHub x_refsource_MISC
Same Patch Batch · frangoteam · 2026-08-18 · 8 CVEs total
| CVE-2026-67443 | 9.2 CRITICAL | FUXA: Unauthenticated guest JWT bypasses Node-RED secure-mode authorization gate (Remote S |
| CVE-2026-47719 | 8.2 HIGH | FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with re |
| CVE-2026-65984 | 7.5 HIGH | FUXA: JWT lifecycle flaws allow deleted or demoted users to retain privileged sessions |
| CVE-2026-67440 | 6.9 MEDIUM | FUXA: Unauthenticated Socket.IO read events |
| CVE-2026-47721 | 6.3 MEDIUM | FUXA: Scheduler API missing admin check enables operator-to-admin escalation via scheduled |
| CVE-2026-65985 | 6.0 MEDIUM | FUXA: SSRF hardening for `device-webapi-request` |
| CVE-2026-67442 | 2.0 LOW | FUXA Business Logic Flaw: Role Deletion Without User Assignment Cleanup |
IV. Related Vulnerabilities
Same product: FUXA
-
CVE-2026-67442
FUXA Business Logic Flaw: Role Deletion Without User Assignm -
CVE-2026-65984
FUXA: JWT lifecycle flaws allow deleted or demoted users to -
CVE-2026-67443
FUXA: Unauthenticated guest JWT bypasses Node-RED secure-mod -
CVE-2026-65985
FUXA: SSRF hardening for `device-webapi-request` -
CVE-2026-67440
FUXA: Unauthenticated Socket.IO read events
Same vendor: frangoteam
-
CVE-2026-67442
FUXA Business Logic Flaw: Role Deletion Without User Assignm -
CVE-2026-65984
FUXA: JWT lifecycle flaws allow deleted or demoted users to -
CVE-2026-67443
FUXA: Unauthenticated guest JWT bypasses Node-RED secure-mod -
CVE-2026-65985
FUXA: SSRF hardening for `device-webapi-request` -
CVE-2026-67440
FUXA: Unauthenticated Socket.IO read events
Same weakness: CWE-89
-
CVE-2026-32555
WordPress Boost plugin <= 2.0.4 - SQL Injection vulnerabilit -
CVE-2026-32554
WordPress WooBeWoo Product Filter Pro plugin <= 3.1.8 - SQL -
CVE-2026-77635
CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL inje -
CVE-2026-76848
TypeORM 0.2.21 through 1.1.0 SQL Injection via SelectQueryBu -
CVE-2026-78248
SourceCodester Simple Online Food Ordering System ajax.php s
V. Comments for CVE-2026-47720
No comments yet