Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
127 results · page 1 of 3
Oct 1, 2026Unsanitized concatenation of the module parameter in the Grafana datasource endpoint allows authenticated blind SQL injection.CVE-2026-75786 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 7.2
Unsanitized concatenation of the module parameter in the Grafana datasource endpoint allows authenticated blind SQL injection. Affects Pandora FMS from 777 onwards.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2026Missing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows stored XSS, executing without user interaCVE-2026-64950 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 8.4
Missing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows stored XSS, executing without user interaction. Affects Pandora FMS from 777 onwards.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2026Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files.CVE-2026-64949 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 8.6
Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files. Affects Pandora FMS from 777 onwards.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2026Missing authorization in module data retrieval allows unauthorized cross-group access to module history.CVE-2026-64948 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 7.1
Missing authorization in module data retrieval allows unauthorized cross-group access to module history. Affects Pandora FMS from 777 onwards.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2026A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP code, resultiCVE-2026-64947 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 7.5
A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP code, resulting in Remote Code Execution. This issue affects Pandora FMS: from 777 onwards.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2026A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltratioCVE-2026-64946 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 7.4
A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltration and administrator account takeover. This issue affects Pandora FMS: from 777 onwards.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2026Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of alert commands via sequential, unvalidated GET requests when an authenticated adCVE-2026-34190 · Other software · Pandora FMS · reported by security@pandorafms.comMedium 5.9
Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of alert commands via sequential, unvalidated GET requests when an authenticated administrator visits a malicious page. This issue affects Pandora FMS: from 777 onwards.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2026Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of event responses via a forged GET request when an authenticated administrator visCVE-2026-34189 · Other software · Pandora FMS · reported by security@pandorafms.comMedium 5.9
Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of event responses via a forged GET request when an authenticated administrator visits a malicious page. This issue affects Pandora FMS: from 777 onwards.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via graph container parameter.CVE-2026-34187 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via graph container parameter. This issue affects Pandora FMS: from 777 through 800
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Server-Side Request Forgery vulnerability allows Privilege Escalation via API Checker extension.CVE-2026-30810 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 7.1
Server-Side Request Forgery vulnerability allows Privilege Escalation via API Checker extension. This issue affects Pandora FMS: from 777 through 800
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Session Fixation vulnerability allows Session Hijacking via crafted session ID.CVE-2026-30808 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 7.6
Session Fixation vulnerability allows Session Hijacking via crafted session ID. This issue affects Pandora FMS: from 777 through 800
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Cross-Site Request Forgery vulnerability allows an attacker to perform unauthorized actions via crafted web page.CVE-2026-30807 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 7.1
Cross-Site Request Forgery vulnerability allows an attacker to perform unauthorized actions via crafted web page. This issue affects Pandora FMS: from 777 through 800
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Insecure Default Initialization of Resource vulnerability allows Authentication Bypass via API access.CVE-2026-30805 · Other software · Pandora FMS · reported by security@pandorafms.comCritical 9.1
Insecure Default Initialization of Resource vulnerability allows Authentication Bypass via API access. This issue affects Pandora FMS: from 777 through 800
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2026Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via Event Response execution.CVE-2026-34188 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 7.5
Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via Event Response execution. This issue affects Pandora FMS: from 777 through 800
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2026Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via custom fields.CVE-2026-34186 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 8.7
Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via custom fields. This issue affects Pandora FMS: from 777 through 800
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2026Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via module search.CVE-2026-30813 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 8.7
Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via module search. This issue affects Pandora FMS: from 777 through 800
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2026Improper Neutralization of Input During Web Page Generation vulnerability allows Stored Cross-Site Scripting via event comments.CVE-2026-30812 · Other software · Pandora FMS · reported by security@pandorafms.comLow 2.1
Improper Neutralization of Input During Web Page Generation vulnerability allows Stored Cross-Site Scripting via event comments. This issue affects Pandora FMS: from 777 through 800
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2026Missing Authorization vulnerability allows Exposure of Sensitive Information via configuration endpoint.CVE-2026-30811 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 8.4
Missing Authorization vulnerability allows Exposure of Sensitive Information via configuration endpoint. This issue affects Pandora FMS: from 777 through 800
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2026Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via WebServerModuleDebug.CVE-2026-30809 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 8.7
Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via WebServerModuleDebug. This issue affects Pandora FMS: from 777 through 800
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2026Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via Network Report.CVE-2026-30806 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 8.7
Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via Network Report. This issue affects Pandora FMS: from 777 through 800
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2026Unrestricted Upload of File with Dangerous Type vulnerability allows Remote Code Execution via file upload.CVE-2026-30804 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 8.6
Unrestricted Upload of File with Dangerous Type vulnerability allows Remote Code Execution via file upload. This issue affects Pandora FMS: from 777 through 800
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2025An unauthenticated remote command execution vulnerability exists in Pandora FMS versions up to and including 5.0RC1 via the Anyterm web interface, which listensCVE-2014-125124 · Other software · Artica ST · reported by VulnCheckCritical 10
An unauthenticated remote command execution vulnerability exists in Pandora FMS versions up to and including 5.0RC1 via the Anyterm web interface, which listens on TCP port 8023. The anyterm-module endpoint accepts unsanitized user input via the p parameter and directly injects it into a shell command, allowing arbitrary command execution as the pandora user. In certain versions (notably 4.1 and 5.0RC1), the pandora user can elevate privileges to root without a password using a chain involving the artica user account. This account is typically installed without a password and is configured to run sudo without authentication. Therefore, full system compromise is possible without any credentials.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comexploit-db.com
Jul 25, 2025An unauthenticated SQL injection vulnerability exists in Pandora FMS version 5.0 SP2 and earlier.CVE-2014-125115 · Other software · Artica ST · reported by VulnCheckCritical 10
An unauthenticated SQL injection vulnerability exists in Pandora FMS version 5.0 SP2 and earlier. The mobile/index.php endpoint fails to properly sanitize user input in the loginhash_data parameter, allowing attackers to extract administrator credentials or active session tokens via crafted requests. This occurs because input is directly concatenated into an SQL query without adequate validation, enabling SQL injection. After authentication is bypassed, a second vulnerability in the File Manager component permits arbitrary PHP file uploads. The file upload functionality does not enforce MIME-type or file extension restrictions, allowing authenticated users to upload web shells into a publicly accessible directory and achieve remote code execution.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comweb.archive.org
Jul 3, 2025An authenticated remote code execution vulnerability exists in Pandora FMS version 7.0NG and earlier.CVE-2025-34088 · Other software · Artica ST · reported by VulnCheckHigh 8.6
An authenticated remote code execution vulnerability exists in Pandora FMS version 7.0NG and earlier. The net_tools.php functionality allows authenticated users to execute arbitrary OS commands via the select_ips parameter when performing network tools operations, such as pinging. This occurs because user input is not properly sanitized before being passed to system commands, enabling command injection.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comraw.githubusercontent.com
Jun 27, 2025Improper Neutralization of Special Elements in the Netflow directory field may allow OS command injection.CVE-2025-5306 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 7
Improper Neutralization of Special Elements in the Netflow directory field may allow OS command injection. This issue affects Pandora FMS 774 through 778
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Improper Neutralization of Special Elements in the chromium_path variable may allow OS command injection.CVE-2025-4678 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 7
Improper Neutralization of Special Elements in the chromium_path variable may allow OS command injection. This issue affects Pandora ITSM 5.0.105.
- Product
- Pandora ITSM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Improper Neutralization of Special Elements in the backup name field may allow OS command injection.CVE-2025-4653 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 7
Improper Neutralization of Special Elements in the backup name field may allow OS command injection. This issue affects Pandora ITSM 5.0.105.
- Product
- Pandora ITSM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2025Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection via RCE.CVE-2024-12992 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 8.6
Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection via RCE. This issue affects Pandora FMS from 700 to 777.6 .
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2025Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection.This issue affects Pandora FMS from 700 to 777.6CVE-2024-12971 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 8.6
Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection.This issue affects Pandora FMS from 700 to 777.6
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2024Arbitrary commands execution on the server by exploiting a command injection vulnerability in the LDAP authentication mechanism.CVE-2024-11320 · Other software · Pandora FMS · reported by security@pandorafms.comMedium 6.9
Arbitrary commands execution on the server by exploiting a command injection vulnerability in the LDAP authentication mechanism. This issue affects Pandora FMS: from 700 through <=777.4
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2024A post-authentication SQL Injection vulnerability within the filters parameter of the extensions/agents_modules_csv functionality.CVE-2024-9987 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 8.6
A post-authentication SQL Injection vulnerability within the filters parameter of the extensions/agents_modules_csv functionality. This issue affects Pandora FMS: from 700 through <777.3.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2024A post-authentication arbitrary file read vulnerability within the server plugins section in plugin edition feature.CVE-2024-35308 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 8.3
A post-authentication arbitrary file read vulnerability within the server plugins section in plugin edition feature. This issue affects Pandora FMS: from 700 through <777.3.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2024Argument Injection Leading to Remote Code Execution in Realtime Graph Extension, allowing unauthenticated attackers to execute arbitrary code on the server.CVE-2024-35307 · Other software · Pandora FMS · reported by security@pandorafms.comCritical 9.4
Argument Injection Leading to Remote Code Execution in Realtime Graph Extension, allowing unauthenticated attackers to execute arbitrary code on the server. This issue affects Pandora FMS: from 700 through <777.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpandorafms.compandorafms.com
Jun 10, 2024OS Command injection in Ajax PHP files via HTTP Request, allows to execute system commands by exploiting variables.CVE-2024-35306 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 8.7
OS Command injection in Ajax PHP files via HTTP Request, allows to execute system commands by exploiting variables. This issue affects Pandora FMS: from 700 through <777.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpandorafms.compandorafms.com
Jun 10, 2024Unauth Time-Based SQL Injection in API allows to exploit HTTP request Authorization header.CVE-2024-35305 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 8.9
Unauth Time-Based SQL Injection in API allows to exploit HTTP request Authorization header. This issue affects Pandora FMS: from 700 through <777.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpandorafms.compandorafms.com
Jun 10, 2024System command injection through Netflow function due to improper input validation, allowing attackers to execute arbitrary system commands.CVE-2024-35304 · Other software · Pandora FMS · reported by security@pandorafms.comCritical 9.3
System command injection through Netflow function due to improper input validation, allowing attackers to execute arbitrary system commands. This issue affects Pandora FMS: from 700 through <777.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpandorafms.compandorafms.com
Mar 19, 2024Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Pandora FMS on all allows OS Command Injection.CVE-2023-44092 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 7.6
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Pandora FMS on all allows OS Command Injection. This vulnerability allowed to create a reverse shell and execute commands in the OS. This issue affects Pandora FMS: from 700 through <776.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpandorafms.compandorafms.com
Mar 19, 2024Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows SQL Injection.CVE-2023-44091 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 7.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows SQL Injection. This ulnerability allowed SQL injections to be made even if authentication failed.This issue affects Pandora FMS: from 700 through <776.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpandorafms.compandorafms.com
Mar 19, 2024 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows CVE-2008-5817.CVE-2023-44090 · Other software · Pandora FMS · reported by security@pandorafms.comMedium 6.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows CVE-2008-5817. This vulnerability allowed SQL changes to be made to several files in the Grafana module. This issue affects Pandora FMS: from 700 through <776.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpandorafms.compandorafms.com
Mar 19, 2024: Path Traversal vulnerability in Pandora FMS on all allows Path Traversal.CVE-2023-41793 · Other software · Pandora FMS · reported by security@pandorafms.comMedium 6.7
: Path Traversal vulnerability in Pandora FMS on all allows Path Traversal. This vulnerability allowed changing directories and creating files and downloading them outside the allowed directories. This issue affects Pandora FMS: from 700 through <776.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpandorafms.compandorafms.com
Dec 29, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS).CVE-2023-44089 · Other software · Pandora FMS · reported by security@pandorafms.comMedium 6.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). It was possible to execute malicious JS code on Visual Consoles. This issue affects Pandora FMS: from 700 through 774.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpandorafms.compandorafms.com
Dec 29, 2023Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows SQL Injection.CVE-2023-44088 · Other software · Pandora FMS · reported by security@pandorafms.comMedium 5.9
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows SQL Injection. Arbitrary SQL queries were allowed to be executed using any account with low privileges. This issue affects Pandora FMS: from 700 through 774.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpandorafms.compandorafms.com
Dec 29, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS).CVE-2023-41815 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 7.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Malicious code could be executed in the File Manager section. This issue affects Pandora FMS: from 700 through 774.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpandorafms.compandorafms.com
Dec 29, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS).CVE-2023-41814 · Other software · Pandora FMS · reported by security@pandorafms.comLow 3.7
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Through an HTML payload (iframe tag) it is possible to carry out XSS attacks when the user receiving the messages opens their notifications. This issue affects Pandora FMS: from 700 through 774.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpandorafms.compandorafms.com
Dec 29, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS).CVE-2023-41813 · Other software · Pandora FMS · reported by security@pandorafms.comLow 3
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Allows you to edit the Web Console user notification options. This issue affects Pandora FMS: from 700 through 774.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpandorafms.compandorafms.com
Nov 23, 2023Cron log backup files contain administrator session IDs.CVE-2023-4677 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 7
Cron log backup files contain administrator session IDs. It is trivial for any attacker who can reach the Pandora FMS Console to scrape the cron logs directory for cron log backups. The contents of these log files can then be abused to authenticate to the application as an administrator. This issue affects Pandora FMS <= 772.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpandorafms.compandorafms.com
Nov 23, 2023Unrestricted Upload of File with Dangerous Type vulnerability in Pandora FMS on all allows Accessing Functionality Not Properly Constrained by ACLs.CVE-2023-41812 · Other software · Pandora FMS · reported by security@pandorafms.comMedium 5.7
Unrestricted Upload of File with Dangerous Type vulnerability in Pandora FMS on all allows Accessing Functionality Not Properly Constrained by ACLs. This vulnerability allowed PHP executable files to be uploaded through the file manager. This issue affects Pandora FMS: from 700 through 773.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpandorafms.compandorafms.com
Nov 23, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS).CVE-2023-41811 · Other software · Pandora FMS · reported by security@pandorafms.comMedium 5.3
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). This vulnerability allowed Javascript code to be executed in the news section of the web console. This issue affects Pandora FMS: from 700 through 773.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpandorafms.compandorafms.com
Nov 23, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS).CVE-2023-41810 · Other software · Pandora FMS · reported by security@pandorafms.comMedium 4
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). This vulnerability allowed Javascript code to be executed in some Widgets' text box. This issue affects Pandora FMS: from 700 through 773.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpandorafms.compandorafms.com
Nov 23, 2023Improper Privilege Management vulnerability in Pandora FMS on all allows Privilege Escalation.CVE-2023-41808 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 8.5
Improper Privilege Management vulnerability in Pandora FMS on all allows Privilege Escalation. This vulnerability allows an unauthorised user to escalate and read sensitive files as if they were root. This issue affects Pandora FMS: from 700 through 773.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpandorafms.compandorafms.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.