Advisories · Technology
Pandora FMS.
Every CVE that names Pandora FMS among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.2 High
SQL Injection in Grafana Integration Endpoint (query.php)
- Pandora FMS
- SQL injection
- CVSS 8.4 High
Stored Cross-Site Scripting via Directory Name in File Manager Create Directory
- Pandora FMS
- Cross-site scripting (XSS)
- CVSS 8.6 High
Unrestricted File Upload Leading to Remote Code Execution in Admin Tools File Manager
- Pandora FMS
- Unrestricted file upload
- CVSS 7.1 High
Missing Authorization in get_module_detail AJAX Endpoint Allows Cross-Group Module Data Disclosure
- Pandora FMS
- Broken access control
- CVSS 7.5 High
CSRF Bypass Leading to Remote Code Execution via Unrestricted File Upload in Plugin File Manager
- Pandora FMS
- Cross-site request forgery (CSRF)
- Unrestricted file upload
- CVSS 7.4 High
CSRF Bypass Leading to Stored Cross-Site Scripting via Unrestricted SVG Upload in File Manager
- Pandora FMS
- Cross-site scripting (XSS)
- Cross-site request forgery (CSRF)
- CVSS 5.9 Medium
CSRF in Alert Command Deletion
- Pandora FMS
- Cross-site request forgery (CSRF)
- CVSS 5.9 Medium
CSRF in Event Response Deletion
- Pandora FMS
- Cross-site request forgery (CSRF)
- CVSS 7.6 High
SQL Injection in Graph Container Parameter
- Pandora FMS
- SQL injection
- CVSS 7.1 High
Server-Side Request Forgery in API Checker leads to Privilege Escalation
- Pandora FMS
- Server-side request forgery (SSRF)
- CVSS 7.6 High
Session Fixation in Authentication leads to Session Hijacking
- Pandora FMS
- Authentication bypass
- CVSS 7.1 High
Cross-Site Request Forgery on Extension Pages
- Pandora FMS
- Cross-site request forgery (CSRF)
- CVSS 9.1 CriticalCritical · CVSS 9+
Insecure Default Initialization in API Authentication leads to Authentication Bypass
- Pandora FMS
- CWE-1188
- CVSS 7.5 High
OS Command Injection in Event Response Execution
- Pandora FMS
- Command injection
- CVSS 8.7 High
SQL Injection in Custom Fields leads to Database Compromise
- Pandora FMS
- SQL injection
- CVSS 8.7 High
SQL Injection in Module Search leads to Database Compromise
- Pandora FMS
- SQL injection
- CVSS 2.1 Low
Stored Cross-Site Scripting in Event Comments via Filter Bypass
- Pandora FMS
- Cross-site scripting (XSS)
- CVSS 8.4 High
Missing Authorization in Configuration Ajax Endpoint leads to Information Disclosure
- Pandora FMS
- Broken access control
- CVSS 8.7 High
OS Command Injection in WebServerModuleDebug via Blacklist Bypass leads to Remote Code Execution
- Pandora FMS
- Command injection
- CVSS 8.7 High
OS Command Injection in Network Report leads to Remote Code Execution
- Pandora FMS
- Command injection
- CVSS 8.6 High
Unrestricted File Upload in Extension Uploader leads to Remote Code Execution
- Pandora FMS
- Unrestricted file upload
- CVSS 7.0 HighCritical · CVSS 7+ and EPSS
Command Injection in Netflow path
- Pandora FMS
- Command injection
- CVSS 8.6 High
Remote Code Execution leads to Command Injection
- Pandora FMS
- Command injection
- CVSS 8.6 HighCritical · CVSS 7+ and EPSS
QuickShell Authenticated Command Injection
- Pandora FMS
- Command injection
- CVSS 6.9 Medium
Command Injection leading to RCE via LDAP Misconfiguration
- Pandora FMS
- Command injection
- CVSS 8.3 High
Post-auth Arbitrary File Read in the Server Plugins Section
- Pandora FMS
- Path traversal
- CVSS 8.6 High
SQL Injection in CSV Module Data Collection
- Pandora FMS
- SQL injection
- CVSS 9.4 CriticalCritical · CVSS 9+
Argument Injection Leading to Remote Code Execution in Realtime Graph Extension
- Pandora FMS
- Command injection
- CVSS 8.7 High
OS Command injection in Ajax PHP files through HTTP Request
- Pandora FMS
- Command injection
- CVSS 8.9 High
Unauth Time-Based SQL Injection via API
- Pandora FMS
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
System command injection through Netflow function
- Pandora FMS
- Command injection
- CVSS 6.7 Medium
Path Traversal and Untrusted Upload File
- Pandora FMS
- Path traversal
- CVSS 7.6 High
OS Command Injection
- Pandora FMS
- Command injection
- CVSS 7.5 High
Unauth Time-Based SQL Injection
- Pandora FMS
- SQL injection
- CVSS 6.8 Medium
UnautH SQL Injection
- Pandora FMS
- SQL injection
- CVSS 6.1 Medium
XSS in Visual Console
- Pandora FMS
- Cross-site scripting (XSS)
- CVSS 5.9 Medium
SQL Injection in Visual Console
- Pandora FMS
- SQL injection
- CVSS 7.5 High
XSS in File manager
- Pandora FMS
- Cross-site scripting (XSS)
- CVSS 3.7 Low
XSS Vulnerability Messages
- Pandora FMS
- Cross-site scripting (XSS)
- CVSS 3.0 Low
User notification settings edition
- Pandora FMS
- Cross-site scripting (XSS)
- CVSS 5.7 Medium
Uploading executables via the file manager
- Pandora FMS
- Unrestricted file upload
- CVSS 5.3 Medium
Stored XSS Via Site News Page
- Pandora FMS
- Cross-site scripting (XSS)
- CVSS 4.0 Medium
Stored XSS Via Dashboard Panel
- Pandora FMS
- Cross-site scripting (XSS)
- CVSS 8.5 High
Arbitrary File Read As Root Via GoTTY Page
- Pandora FMS
- Privilege escalation
- CVSS 9.1 CriticalCritical · CVSS 9+
Linux Local Privilege Escalation Via GoTTY Page
- Pandora FMS
- Privilege escalation
- CVSS 8.2 High
Misassignment of privileges can cause DOS attack
- Pandora FMS
- Privilege escalation
- CVSS 5.9 Medium
Lack of Authorization and Stored XSS Via SNMP Trap Editor Page
- Pandora FMS
- Cross-site request forgery (CSRF)
- CVSS 8.4 High
Lack of Authorization and Stored XSS Via Translation Abuse
- Pandora FMS
- Cross-site scripting (XSS)
- CVSS 7.6 High
Traversal Path on PHP file
- Pandora FMS
- CWE-427
- CVSS 7.6 High
Unauthenticated Admin Account Takeover Via XSS
- Pandora FMS
- Cross-site scripting (XSS)
- CVSS 7.6 High
Remote Code Execution via File Uploader
- Pandora FMS
- Unrestricted file upload
- CVSS 6.0 Medium
Arbitrary File Read
- Pandora FMS
- CWE-427
- CVSS 6.8 Medium
Database backups availability by low-privileged users
- Pandora FMS
- Information disclosure
- CVSS 7.0 High
Unauthenticated Admin Account Takeover Via Cron Log File Backups
- Pandora FMS
- Authentication bypass