CVE-2025-69985
70Vexday Risk Score
Prioritize patching. It exploitation observed by VulnCheck and has a public proof of concept.
ssvc Actcvss 9.8epss 5.6%
from disclosure to weapon0 days
Published on NVDFeb 24
1st PoCApr 10
VulnCheck+59d
exploitation probability
5.6%top 8% of all CVEs
observed exploitation
yesVulnCheck
7 public exploit(s)
FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE). The vulnerability exists in the server/api/jwt-helper.js middleware, which improperly trusts the HTTP "Referer" header to validate internal requests. A remote unauthenticated attacker can bypass JWT authentication by spoofing the Referer header to match the server's host. Successful exploitation allows the attacker to access the protected /api/runscript endpoint and execute arbitrary Node.js code on the server.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/apublic PoCs found — 7
exploitdbwww.exploit-db.com/exploits/52544unverifiedgithubgithub.com/joshuavanderpoll/CVE-2025-69985★ 3githubgithub.com/kaleth4/CVE-2025-69985★ 0githubgithub.com/tianarsamm/CVE-2025-69985★ 0vulncheckvulncheck.com/xdb/f4f0bc90cbebunverifiedvulncheckvulncheck.com/xdb/5ab93da3d8f6unverifiedvulncheckvulncheck.com/xdb/88afbae2c064unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.