CVE-2021-46678

Vulnerability XSS in service form name field

A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via the service name field.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed

Vendors

Pandorafms

Products

Pandora Fms

CVE-2021-46680

Vulnerability XSS in module form name field

A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via the module form name field.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed

Vendors

Pandorafms

Products

Pandora Fms

CVE-2021-46677

Vulnerability XSS in Event filter name field

A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via the event filter name field.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed

Vendors

Pandorafms

Products

Pandora Fms

CVE-2021-46676

Vulnerability XSS in Transaction Map name field

A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via the transactional maps name field.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed

Vendors

Pandorafms

Products

Pandora Fms

CVE-2021-46679

Vulnerability XSS in service elements

A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via service elements.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed

Vendors

Pandorafms

Products

Pandora Fms

CVE-2014-125115

Pandora FMS ≤ 5.0 SP2 Default Credential SQL Injection RCE

An unauthenticated SQL injection vulnerability exists in Pandora FMS version 5.0 SP2 and earlier. The mobile/index.php endpoint fails to properly sanitize user input in the loginhash_data parameter, allowing attackers to extract administrator credentials or active session tokens via crafted requests. This occurs because input is directly concatenated into an SQL query without adequate validation, enabling SQL injection. After authentication is bypassed, a second vulnerability in the File Manager component permits arbitrary PHP file uploads. The file upload functionality does not enforce MIME-type or file extension restrictions, allowing authenticated users to upload web shells into a publicly accessible directory and achieve remote code execution.

CVSS 4.0 · 10 Critical EPSS 2.6% KEV · Not listed

Vendors

Artica Pandora Fms Pandorafms

Products

Pandora Fms Pandora Fms Pandora Fms

CVE-2014-125124

Pandora FMS <= 5.0RC1 Anyterm Unauthenticated Command Injection

An unauthenticated remote command execution vulnerability exists in Pandora FMS versions up to and including 5.0RC1 via the Anyterm web interface, which listens on TCP port 8023. The anyterm-module endpoint accepts unsanitized user input via the p parameter and directly injects it into a shell command, allowing arbitrary command execution as the pandora user. In certain versions (notably 4.1 and 5.0RC1), the pandora user can elevate privileges to root without a password using a chain involving the artica user account. This account is typically installed without a password and is configured to run sudo without authentication. Therefore, full system compromise is possible without any credentials.

CVSS 4.0 · 10 Critical EPSS 2.4% KEV · Not listed

Vendors

Artica Pandora Fms Pandorafms

Products

Pandora Fms Pandora Fms Artica Pandora Fms and 1 more

CVE-2025-34088

Pandora FMS Authenticated Remote Code Execution via Ping Module

An authenticated remote code execution vulnerability exists in Pandora FMS version 7.0NG and earlier. The net_tools.php functionality allows authenticated users to execute arbitrary OS commands via the select_ips parameter when performing network tools operations, such as pinging. This occurs because user input is not properly sanitized before being passed to system commands, enabling command injection.

CVSS 4.0 · 8.6 High EPSS 7.4% KEV · Not listed

Vendors

Artica Pandora Fms Pandorafms

Products

Pandora Fms Pandora Fms Pandora Fms

CVE-2024-35307

Argument Injection Leading to Remote Code Execution in Realtime Graph Extension

Argument Injection Leading to Remote Code Execution in Realtime Graph Extension, allowing unauthenticated attackers to execute arbitrary code on the server. This issue affects Pandora FMS: from 700 through <777.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Artica Pandorafms

Products

Pandora Fms Pandora Fms

CVE-2024-35304

System command injection through Netflow function

System command injection through Netflow function due to improper input validation, allowing attackers to execute arbitrary system commands. This issue affects Pandora FMS: from 700 through <777.

CVSS 4.0 · 9.3 Critical EPSS 1.1% KEV · Not listed

Vendors

Artica Pandorafms

Products

Pandora Fms Pandora Fms

CVE-2023-44088

SQL Injection in Visual Console

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows SQL Injection. Arbitrary SQL queries were allowed to be executed using any account with low privileges. This issue affects Pandora FMS: from 700 through 774.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Pandorafms

Products

Pandora Fms

CVE-2022-47373

Reflected Cross Site Scripting in Search Functionality of Module Library

Reflected Cross Site Scripting in Search Functionality of Module Library in Pandora FMS Console v766 and lower. This vulnerability arises on the forget password functionality in which parameter username does not proper input validation/sanitization thus results in executing malicious JavaScript payload.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Pandorafms

Products

Pandora Fms

CVE-2022-43978

Limited Authentication bypass due to hardcoded secret

There is an improper authentication vulnerability in Pandora FMS v764. The application verifies that the user has a valid session when he is not trying to do a login. Since the secret is static in generatePublicHash function, an attacker with knowledge of a valid session can abuse this in order to pass the authentication check.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Pandorafms

Products

Pandora Fms

CVE-2022-43979

Path Traversal leading to Local File Inclusion

There is a Path Traversal that leads to a Local File Inclusion in Pandora FMS v764. A function is called to check that the parameter that the user has inserted does not contain malicious characteres, but this check is insufficient. An attacker could insert an absolute path to overcome the heck, thus being able to incluse any PHP file that resides on the disk. The exploitation of this vulnerability could lead to a remote code execution.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Pandorafms

Products

Pandora Fms

CVE-2022-43980

Cross-site scripting vulnerability in the network maps edit functionality

There is a stored cross-site scripting vulnerability in Pandora FMS v765 in the network maps editing functionality. An attacker could modify a network map, including on purpose the name of an XSS payload. Once created, if a user with admin privileges clicks on the edited network maps, the XSS payload will be executed. The exploitation of this vulnerability could allow an atacker to steal the value of the admin user´s cookie.

CVSS 3.1 · 5.2 Medium EPSS < 1% KEV · Not listed

Vendors

Pandorafms

Products

Pandora Fms

CVE-2022-45436

Stored cross-site scripting vulnerability in network maps editor feature

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Artica PFMS Pandora FMS v765 on all platforms, allows Cross-Site Scripting (XSS). As a manager privilege user , create a network map containing name as xss payload. Once created, admin user must click on the edit network maps and XSS payload will be executed, which could be used for stealing admin users cookie value.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Pandorafms

Products

Pandora Fms

CVE-2022-45437

Stored cross-site scripting vulnerability in the reporting dashboard module

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Artica PFMS Pandora FMS v765 on all allows Cross-Site Scripting (XSS). A user with edition privileges can create a Payload in the reporting dashboard module. An admin user can observe the Payload without interaction and attacker can get information.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Pandorafms

Products

Pandora Fms

CVE-2022-47372

Stored cross-site scripting vulnerability in create event section

Stored cross-site scripting vulnerability in the Create event section in Pandora FMS Console v766 and lower. An attacker typically exploits this vulnerability by injecting XSS payloads on popular pages of a site or passing a link to a victim, tricking them into viewing the page that contains the stored XSS payload.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Pandorafms

Products

Pandora Fms

CVE-2023-2807

Authentication bypass in password reset process

Authentication Bypass by Spoofing vulnerability in the password reset process of Pandora FMS allows an unauthenticated attacker to initiate a password reset process for any user account without proper authentication. This issue affects PandoraFMS v771 and prior versions on all platforms.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Pandorafms

Products

Pandora Fms

CVE-2024-11320

Command Injection leading to RCE via LDAP Misconfiguration

Arbitrary commands execution on the server by exploiting a command injection vulnerability in the LDAP authentication mechanism. This issue affects Pandora FMS: from 700 through <=777.4

CVSS 4.0 · 6.9 Medium EPSS 91.2% KEV · Not listed

Vendors

Pandorafms

Products

Pandora Fms