CVE-2021-46681

Vulnerability XSS in module mass operation name field

A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via module massive operation name field.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed

Vendors

Artica

Products

Pandora Fms

CVE-2026-34187

SQL Injection in Graph Container Parameter

Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via graph container parameter. This issue affects Pandora FMS: from 777 through 800

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Artica Pandora Fms

Products

Pandora Fms Pandora Fms

CVE-2026-30805

Insecure Default Initialization in API Authentication leads to Authentication Bypass

Insecure Default Initialization of Resource vulnerability allows Authentication Bypass via API access. This issue affects Pandora FMS: from 777 through 800

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Artica Pandora Fms

Products

Pandora Fms Pandora Fms

CVE-2026-30807

Cross-Site Request Forgery on Extension Pages

Cross-Site Request Forgery vulnerability allows an attacker to perform unauthorized actions via crafted web page. This issue affects Pandora FMS: from 777 through 800

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Artica Pandora Fms

Products

Pandora Fms Pandora Fms

CVE-2026-30810

Server-Side Request Forgery in API Checker leads to Privilege Escalation

Server-Side Request Forgery vulnerability allows Privilege Escalation via API Checker extension. This issue affects Pandora FMS: from 777 through 800

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Artica Pandora Fms

Products

Pandora Fms Pandora Fms

CVE-2026-30808

Session Fixation in Authentication leads to Session Hijacking

Session Fixation vulnerability allows Session Hijacking via crafted session ID. This issue affects Pandora FMS: from 777 through 800

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Artica Pandora Fms

Products

Pandora Fms Pandora Fms

CVE-2026-34186

SQL Injection in Custom Fields leads to Database Compromise

Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via custom fields. This issue affects Pandora FMS: from 777 through 800

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Artica Pandora Fms

Products

Pandora Fms Pandora Fms

CVE-2026-30813

SQL Injection in Module Search leads to Database Compromise

Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via module search. This issue affects Pandora FMS: from 777 through 800

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Artica Pandora Fms

Products

Pandora Fms Pandora Fms

CVE-2026-30812

Stored Cross-Site Scripting in Event Comments via Filter Bypass

Improper Neutralization of Input During Web Page Generation vulnerability allows Stored Cross-Site Scripting via event comments. This issue affects Pandora FMS: from 777 through 800

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Artica Pandora Fms

Products

Pandora Fms Pandora Fms

CVE-2026-30809

OS Command Injection in WebServerModuleDebug via Blacklist Bypass leads to Remote Code Execution

Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via WebServerModuleDebug. This issue affects Pandora FMS: from 777 through 800

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Artica Pandora Fms

Products

Pandora Fms Pandora Fms

CVE-2026-30806

OS Command Injection in Network Report leads to Remote Code Execution

Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via Network Report. This issue affects Pandora FMS: from 777 through 800

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Artica Pandora Fms

Products

Pandora Fms Pandora Fms

CVE-2026-30804

Unrestricted File Upload in Extension Uploader leads to Remote Code Execution

Unrestricted Upload of File with Dangerous Type vulnerability allows Remote Code Execution via file upload. This issue affects Pandora FMS: from 777 through 800

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Artica Pandora Fms

Products

Pandora Fms Pandora Fms

CVE-2026-30811

Missing Authorization in Configuration Ajax Endpoint leads to Information Disclosure

Missing Authorization vulnerability allows Exposure of Sensitive Information via configuration endpoint. This issue affects Pandora FMS: from 777 through 800

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Artica Pandora Fms

Products

Pandora Fms Pandora Fms

CVE-2026-34188

OS Command Injection in Event Response Execution

Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via Event Response execution. This issue affects Pandora FMS: from 777 through 800

CVSS 4.0 · 7.5 High EPSS 1.1% KEV · Not listed

Vendors

Artica Pandora Fms

Products

Pandora Fms Pandora Fms

CVE-2014-125115

Pandora FMS ≤ 5.0 SP2 Default Credential SQL Injection RCE

An unauthenticated SQL injection vulnerability exists in Pandora FMS version 5.0 SP2 and earlier. The mobile/index.php endpoint fails to properly sanitize user input in the loginhash_data parameter, allowing attackers to extract administrator credentials or active session tokens via crafted requests. This occurs because input is directly concatenated into an SQL query without adequate validation, enabling SQL injection. After authentication is bypassed, a second vulnerability in the File Manager component permits arbitrary PHP file uploads. The file upload functionality does not enforce MIME-type or file extension restrictions, allowing authenticated users to upload web shells into a publicly accessible directory and achieve remote code execution.

CVSS 4.0 · 10 Critical EPSS 2.6% KEV · Not listed

Vendors

Artica Pandora Fms Pandorafms

Products

Pandora Fms Pandora Fms Pandora Fms

CVE-2014-125124

Pandora FMS <= 5.0RC1 Anyterm Unauthenticated Command Injection

An unauthenticated remote command execution vulnerability exists in Pandora FMS versions up to and including 5.0RC1 via the Anyterm web interface, which listens on TCP port 8023. The anyterm-module endpoint accepts unsanitized user input via the p parameter and directly injects it into a shell command, allowing arbitrary command execution as the pandora user. In certain versions (notably 4.1 and 5.0RC1), the pandora user can elevate privileges to root without a password using a chain involving the artica user account. This account is typically installed without a password and is configured to run sudo without authentication. Therefore, full system compromise is possible without any credentials.

CVSS 4.0 · 10 Critical EPSS 2.4% KEV · Not listed

Vendors

Artica Pandora Fms Pandorafms

Products

Pandora Fms Pandora Fms Artica Pandora Fms and 1 more

CVE-2025-34088

Pandora FMS Authenticated Remote Code Execution via Ping Module

An authenticated remote code execution vulnerability exists in Pandora FMS version 7.0NG and earlier. The net_tools.php functionality allows authenticated users to execute arbitrary OS commands via the select_ips parameter when performing network tools operations, such as pinging. This occurs because user input is not properly sanitized before being passed to system commands, enabling command injection.

CVSS 4.0 · 8.6 High EPSS 7.4% KEV · Not listed

Vendors

Artica Pandora Fms Pandorafms

Products

Pandora Fms Pandora Fms Pandora Fms

CVE-2024-35307

Argument Injection Leading to Remote Code Execution in Realtime Graph Extension

Argument Injection Leading to Remote Code Execution in Realtime Graph Extension, allowing unauthenticated attackers to execute arbitrary code on the server. This issue affects Pandora FMS: from 700 through <777.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Artica Pandorafms

Products

Pandora Fms Pandora Fms

CVE-2024-12971

QuickShell Authenticated Command Injection

Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection.This issue affects Pandora FMS from 700 to 777.6

CVSS 4.0 · 8.6 High EPSS 61.5% KEV · Not listed

Vendors

Artica Pandora Fms

Products

Pandora Fms Pandora Fms

CVE-2024-12992

Remote Code Execution leads to Command Injection

Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection via RCE. This issue affects Pandora FMS from 700 to 777.6 .

CVSS 4.0 · 8.6 High EPSS 1.2% KEV · Not listed

Vendors

Artica Pandora Fms

Products

Pandora Fms Pandora Fms