Pandora FMS — recent CVEs

CVE-2026-75786 · 7.2 HIGH — SQL Injection in Grafana Integration Endpoint (query.php)

Thu, 01 Oct 2026 09:30:48 GMT

Unsanitized concatenation of the module parameter in the Grafana datasource endpoint allows authenticated blind SQL injection. Affects Pandora FMS from 777 onwards.

CVE-2026-64950 · 8.4 HIGH — Stored Cross-Site Scripting via Directory Name in File Manager Create Directory

Thu, 01 Oct 2026 09:30:09 GMT

Missing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows stored XSS, executing without user interaction. Affects Pandora FMS from 777 onwards.

CVE-2026-64949 · 8.6 HIGH — Unrestricted File Upload Leading to Remote Code Execution in Admin Tools File Manager

Thu, 01 Oct 2026 09:29:30 GMT

Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files. Affects Pandora FMS from 777 onwards.

CVE-2026-64948 · 7.1 HIGH — Missing Authorization in get_module_detail AJAX Endpoint Allows Cross-Group Module Data Disclosure

Thu, 01 Oct 2026 09:28:33 GMT

Missing authorization in module data retrieval allows unauthorized cross-group access to module history. Affects Pandora FMS from 777 onwards.

CVE-2026-64947 · 7.5 HIGH 🌩️ — CSRF Bypass Leading to Remote Code Execution via Unrestricted File Upload in Plugin File Manager

Thu, 01 Oct 2026 09:27:46 GMT

A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP code, resulting in Remote Code Execution. This issue affects Pandora FMS: from 777 onwards.

CVE-2026-64946 · 7.4 HIGH 🌩️ — CSRF Bypass Leading to Stored Cross-Site Scripting via Unrestricted SVG Upload in File Manager

Thu, 01 Oct 2026 09:26:53 GMT

A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltration and administrator account takeover. This issue affects Pandora FMS: from 777 onwards.

CVE-2026-34190 · 5.9 MEDIUM 🌩️ — CSRF in Alert Command Deletion

Thu, 01 Oct 2026 09:26:00 GMT

Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of alert commands via sequential, unvalidated GET requests when an authenticated administrator visits a malicious page. This issue affects Pandora FMS: from 777 onwards.

CVE-2026-34189 · 5.9 MEDIUM 🌩️ — CSRF in Event Response Deletion

Thu, 01 Oct 2026 09:24:43 GMT

Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of event responses via a forged GET request when an authenticated administrator visits a malicious page. This issue affects Pandora FMS: from 777 onwards.

CVE-2026-34187 · 7.6 HIGH — SQL Injection in Graph Container Parameter

Tue, 12 May 2026 15:13:28 GMT

Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via graph container parameter. This issue affects Pandora FMS: from 777 through 800

CVE-2026-30810 · 7.1 HIGH — Server-Side Request Forgery in API Checker leads to Privilege Escalation

Tue, 12 May 2026 15:12:46 GMT

Server-Side Request Forgery vulnerability allows Privilege Escalation via API Checker extension. This issue affects Pandora FMS: from 777 through 800

CVE-2026-30808 · 7.6 HIGH 🌩️ — Session Fixation in Authentication leads to Session Hijacking

Tue, 12 May 2026 15:11:45 GMT

Session Fixation vulnerability allows Session Hijacking via crafted session ID. This issue affects Pandora FMS: from 777 through 800

CVE-2026-30807 · 7.1 HIGH 🌩️ — Cross-Site Request Forgery on Extension Pages

Tue, 12 May 2026 15:11:01 GMT

Cross-Site Request Forgery vulnerability allows an attacker to perform unauthorized actions via crafted web page. This issue affects Pandora FMS: from 777 through 800

CVE-2026-30805 · 9.1 CRITICAL 🌩️ — Insecure Default Initialization in API Authentication leads to Authentication Bypass

Tue, 12 May 2026 15:09:57 GMT

Insecure Default Initialization of Resource vulnerability allows Authentication Bypass via API access. This issue affects Pandora FMS: from 777 through 800

CVE-2026-34188 · 7.5 HIGH — OS Command Injection in Event Response Execution

Mon, 13 Apr 2026 15:50:41 GMT

Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via Event Response execution. This issue affects Pandora FMS: from 777 through 800

CVE-2026-34186 · 8.7 HIGH — SQL Injection in Custom Fields leads to Database Compromise

Mon, 13 Apr 2026 15:49:55 GMT

Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via custom fields. This issue affects Pandora FMS: from 777 through 800

CVE-2026-30813 · 8.7 HIGH — SQL Injection in Module Search leads to Database Compromise

Mon, 13 Apr 2026 15:49:13 GMT

Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via module search. This issue affects Pandora FMS: from 777 through 800

CVE-2026-30812 · 2.1 LOW — Stored Cross-Site Scripting in Event Comments via Filter Bypass

Mon, 13 Apr 2026 15:48:29 GMT

Improper Neutralization of Input During Web Page Generation vulnerability allows Stored Cross-Site Scripting via event comments. This issue affects Pandora FMS: from 777 through 800

CVE-2026-30811 · 8.4 HIGH — Missing Authorization in Configuration Ajax Endpoint leads to Information Disclosure

Mon, 13 Apr 2026 15:47:40 GMT

Missing Authorization vulnerability allows Exposure of Sensitive Information via configuration endpoint. This issue affects Pandora FMS: from 777 through 800

CVE-2026-30809 · 8.7 HIGH — OS Command Injection in WebServerModuleDebug via Blacklist Bypass leads to Remote Code Execution

Mon, 13 Apr 2026 15:46:53 GMT

Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via WebServerModuleDebug. This issue affects Pandora FMS: from 777 through 800

CVE-2026-30806 · 8.7 HIGH — OS Command Injection in Network Report leads to Remote Code Execution

Mon, 13 Apr 2026 15:45:46 GMT

Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via Network Report. This issue affects Pandora FMS: from 777 through 800

CVE-2026-30804 · 8.6 HIGH — Unrestricted File Upload in Extension Uploader leads to Remote Code Execution

Mon, 13 Apr 2026 15:44:46 GMT

Unrestricted Upload of File with Dangerous Type vulnerability allows Remote Code Execution via file upload. This issue affects Pandora FMS: from 777 through 800

CVE-2025-5306 · 7 HIGH — Command Injection in Netflow path

Fri, 27 Jun 2025 07:48:15 GMT

Improper Neutralization of Special Elements in the Netflow directory field may allow OS command injection. This issue affects Pandora FMS 774 through 778

CVE-2025-4678 · 7 HIGH — Remote Code Execution leads to Command Injection

Tue, 10 Jun 2025 15:54:55 GMT

Improper Neutralization of Special Elements in the chromium_path variable may allow OS command injection. This issue affects Pandora ITSM 5.0.105.

CVE-2025-4653 · 7 HIGH — Remote Code Execution leads to Command Injection

Tue, 10 Jun 2025 15:53:22 GMT

Improper Neutralization of Special Elements in the backup name field may allow OS command injection. This issue affects Pandora ITSM 5.0.105.

CVE-2024-12992 · 8.6 HIGH — Remote Code Execution leads to Command Injection

Mon, 17 Mar 2025 09:21:39 GMT

Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection via RCE. This issue affects Pandora FMS from 700 to 777.6 .

CVE-2024-12971 · 8.6 HIGH — QuickShell Authenticated Command Injection

Mon, 17 Mar 2025 09:19:31 GMT

Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection.This issue affects Pandora FMS from 700 to 777.6

CVE-2024-11320 · 6.9 MEDIUM — Command Injection leading to RCE via LDAP Misconfiguration

Thu, 21 Nov 2024 10:03:08 GMT

Arbitrary commands execution on the server by exploiting a command injection vulnerability in the LDAP authentication mechanism. This issue affects Pandora FMS: from 700 through <=777.4

CVE-2024-35308 · 8.3 HIGH — Post-auth Arbitrary File Read in the Server Plugins Section

Tue, 22 Oct 2024 09:03:15 GMT

A post-authentication arbitrary file read vulnerability within the server plugins section in plugin edition feature. This issue affects Pandora FMS: from 700 through <777.3.

CVE-2024-9987 · 8.6 HIGH — SQL Injection in CSV Module Data Collection

Tue, 22 Oct 2024 09:00:57 GMT

A post-authentication SQL Injection vulnerability within the filters parameter of the extensions/agents_modules_csv functionality. This issue affects Pandora FMS: from 700 through <777.3.

CVE-2024-35307 · 9.4 CRITICAL — Argument Injection Leading to Remote Code Execution in Realtime Graph Extension

Mon, 10 Jun 2024 14:33:29 GMT

Argument Injection Leading to Remote Code Execution in Realtime Graph Extension, allowing unauthenticated attackers to execute arbitrary code on the server. This issue affects Pandora FMS: from 700 through <777.

CVE-2024-35306 · 8.7 HIGH — OS Command injection in Ajax PHP files through HTTP Request

Mon, 10 Jun 2024 14:30:36 GMT

OS Command injection in Ajax PHP files via HTTP Request, allows to execute system commands by exploiting variables. This issue affects Pandora FMS: from 700 through <777.

CVE-2024-35305 · 8.9 HIGH — Unauth Time-Based SQL Injection via API

Mon, 10 Jun 2024 14:28:18 GMT

Unauth Time-Based SQL Injection in API allows to exploit HTTP request Authorization header. This issue affects Pandora FMS: from 700 through <777.

CVE-2024-35304 · 9.3 CRITICAL — System command injection through Netflow function

Mon, 10 Jun 2024 14:21:10 GMT

System command injection through Netflow function due to improper input validation, allowing attackers to execute arbitrary system commands. This issue affects Pandora FMS: from 700 through <777.

CVE-2023-41793 · 6.7 MEDIUM — Path Traversal and Untrusted Upload File

Tue, 19 Mar 2024 16:34:48 GMT

: Path Traversal vulnerability in Pandora FMS on all allows Path Traversal. This vulnerability allowed changing directories and creating files and downloading them outside the allowed directories. This issue affects Pandora FMS: from 700 through <776…

CVE-2023-44092 · 7.6 HIGH — OS Command Injection

Tue, 19 Mar 2024 16:32:54 GMT

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Pandora FMS on all allows OS Command Injection. This vulnerability allowed to create a reverse shell and execute commands in the OS. This issu…

CVE-2023-44091 · 7.5 HIGH — Unauth Time-Based SQL Injection

Tue, 19 Mar 2024 16:31:38 GMT

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows SQL Injection. This ulnerability allowed SQL injections to be made even if authentication failed.This issue affects Pandor…

CVE-2023-44090 · 6.8 MEDIUM — UnautH SQL Injection

Tue, 19 Mar 2024 16:26:12 GMT

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows CVE-2008-5817. This vulnerability allowed SQL changes to be made to several files in the Grafana module. This issue affect…

CVE-2023-44089 · 6.1 MEDIUM — XSS in Visual Console

Fri, 29 Dec 2023 11:50:00 GMT

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). It was possible to execute malicious JS code on Visual Consoles. This issue affects Pandora FM…

CVE-2023-44088 · 5.9 MEDIUM — SQL Injection in Visual Console

Fri, 29 Dec 2023 11:48:12 GMT

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows SQL Injection. Arbitrary SQL queries were allowed to be executed using any account with low privileges. This issue affects…

CVE-2023-41815 · 7.5 HIGH — XSS in File manager

Fri, 29 Dec 2023 11:46:46 GMT

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Malicious code could be executed in the File Manager section. This issue affects Pandora FMS:…

CVE-2023-41814 · 3.7 LOW — XSS Vulnerability Messages

Fri, 29 Dec 2023 11:45:23 GMT

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Through an HTML payload (iframe tag) it is possible to carry out XSS attacks when the user rec…

CVE-2023-41813 · 3 LOW — User notification settings edition

Fri, 29 Dec 2023 11:42:59 GMT

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Allows you to edit the Web Console user notification options. This issue affects Pandora FMS:…

CVE-2023-41812 · 5.7 MEDIUM — Uploading executables via the file manager

Thu, 23 Nov 2023 14:58:44 GMT

Unrestricted Upload of File with Dangerous Type vulnerability in Pandora FMS on all allows Accessing Functionality Not Properly Constrained by ACLs. This vulnerability allowed PHP executable files to be uploaded through the file manager. This issue a…

CVE-2023-41811 · 5.3 MEDIUM — Stored XSS Via Site News Page

Thu, 23 Nov 2023 14:54:41 GMT

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). This vulnerability allowed Javascript code to be executed in the news section of the web conso…

CVE-2023-41810 · 4 MEDIUM — Stored XSS Via Dashboard Panel

Thu, 23 Nov 2023 14:52:59 GMT

CVE-2023-41808 · 8.5 HIGH — Arbitrary File Read As Root Via GoTTY Page

Thu, 23 Nov 2023 14:51:17 GMT

Improper Privilege Management vulnerability in Pandora FMS on all allows Privilege Escalation. This vulnerability allows an unauthorised user to escalate and read sensitive files as if they were root. This issue affects Pandora FMS: from 700 through…

CVE-2023-41807 · 9.1 CRITICAL — Linux Local Privilege Escalation Via GoTTY Page

Thu, 23 Nov 2023 14:49:41 GMT

Improper Privilege Management vulnerability in Pandora FMS on all allows Privilege Escalation. This vulnerability allows a user to escalate permissions on the system shell. This issue affects Pandora FMS: from 700 through 773.

CVE-2023-41806 · 8.2 HIGH 🌩️ — Misassignment of privileges can cause DOS attack

Thu, 23 Nov 2023 14:47:54 GMT

Improper Privilege Management vulnerability in Pandora FMS on all allows Privilege Escalation. This vulnerability causes that a bad privilege assignment could cause a DOS attack that affects the availability of the Pandora FMS server. This issue affe…

CVE-2023-41792 · 5.9 MEDIUM — Lack of Authorization and Stored XSS Via SNMP Trap Editor Page

Thu, 23 Nov 2023 14:45:33 GMT

Cross-Site Request Forgery (CSRF) vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). This vulnerability allowed Javascript code to be executed in the SNMP Trap Editor. This issue affects Pandora FMS: from 700 through 773.

CVE-2023-41791 · 8.4 HIGH — Lack of Authorization and Stored XSS Via Translation Abuse

Thu, 23 Nov 2023 14:41:46 GMT

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). This vulnerability allowed users with low privileges to introduce Javascript executables via a…