Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
142 results · page 1 of 3
Oct 1, 2026Unsanitized concatenation of the module parameter in the Grafana datasource endpoint allows authenticated blind SQL injection.CVE-2026-75786 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 7.2
Unsanitized concatenation of the module parameter in the Grafana datasource endpoint allows authenticated blind SQL injection. Affects Pandora FMS from 777 onwards.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2026Missing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows stored XSS, executing without user interaCVE-2026-64950 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 8.4
Missing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows stored XSS, executing without user interaction. Affects Pandora FMS from 777 onwards.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2026Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files.CVE-2026-64949 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 8.6
Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files. Affects Pandora FMS from 777 onwards.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2026Missing authorization in module data retrieval allows unauthorized cross-group access to module history.CVE-2026-64948 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 7.1
Missing authorization in module data retrieval allows unauthorized cross-group access to module history. Affects Pandora FMS from 777 onwards.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2026A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP code, resultiCVE-2026-64947 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 7.5
A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP code, resulting in Remote Code Execution. This issue affects Pandora FMS: from 777 onwards.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2026A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltratioCVE-2026-64946 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 7.4
A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltration and administrator account takeover. This issue affects Pandora FMS: from 777 onwards.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2026Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of alert commands via sequential, unvalidated GET requests when an authenticated adCVE-2026-34190 · Other software · Pandora FMS · reported by security@pandorafms.comMedium 5.9
Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of alert commands via sequential, unvalidated GET requests when an authenticated administrator visits a malicious page. This issue affects Pandora FMS: from 777 onwards.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2026Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of event responses via a forged GET request when an authenticated administrator visCVE-2026-34189 · Other software · Pandora FMS · reported by security@pandorafms.comMedium 5.9
Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of event responses via a forged GET request when an authenticated administrator visits a malicious page. This issue affects Pandora FMS: from 777 onwards.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2026Pandora contains a path traversal vulnerability in its archive extraction worker.CVE-2026-88069 · Other software · pandora-analysis · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8Critical 9.3
Pandora contains a path traversal vulnerability in its archive extraction worker. When processing a specially crafted archive or disk image, attacker-controlled file paths could be used without ensuring that the resulting destination remained within the intended extraction directory. An attacker able to submit a malicious file for analysis could use path traversal sequences or crafted paths to cause extracted content to be written outside the designated extraction directory, potentially overwriting files accessible to the Pandora worker process. Successful exploitation could result in unauthorized modification of application or system files, denial of service, and potentially further compromise depending on the permissions of the Pandora process and the files that can be overwritten. The vulnerability is addressed by resolving each extraction destination path before writing and verifying that it remains below the expected extraction directory. Extraction attempts resolving outside this directory are rejected and reported as path traversal attempts.
- Product
- pandora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026Pandora contains a stored cross-site scripting (XSS) vulnerability in the rendering of URL observables.CVE-2026-75531 · Other software · pandora-analysis · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8High 7
Pandora contains a stored cross-site scripting (XSS) vulnerability in the rendering of URL observables. A URL extracted from or associated with an analyzed file was inserted directly into the inline JavaScript onclick handler used by the Submit to Lookyloo action. Although the value was subject to HTML escaping by the template engine, it was embedded inside a JavaScript string within an HTML attribute. An attacker-controlled URL containing specially crafted characters could therefore break out of the JavaScript string and inject arbitrary JavaScript code. The malicious script would execute in the context of the Pandora web application when a victim interacts with the affected Submit to Lookyloo control. Successful exploitation could allow an attacker to access information available to the victim's browser or perform actions using the victim's authenticated Pandora session. The patch removes the observable value from the inline JavaScript handler. The URL is instead stored in an HTML data-url attribute and retrieved through the DOM dataset API when needed. Additional uses of innerHTML were also replaced with textContent as defensive hardening.
- Product
- pandora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026Pandora is affected by a stored cross-site scripting vulnerability in the PDF download functionality.CVE-2026-75529 · Other software · pandora-analysis · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8Medium 6.9
Pandora is affected by a stored cross-site scripting vulnerability in the PDF download functionality. The /task-download/<task_id>/.../pdf endpoint verifies that the submitted file is a PDF using Pandora's content-based file-type detection, but previously returned the file using send_file(task.file.path) without explicitly specifying the MIME type or forcing it to be downloaded as an attachment. Because Flask determines the response MIME type from the filename when a path is supplied, an attacker could submit a file whose content is recognized by Pandora as a PDF while its filename or extension causes the download endpoint to return it with a different, potentially active MIME type. A specially crafted PDF/polyglot file could therefore be served inline and interpreted by a victim's browser as HTML or another executable web format. If a victim with access to the submitted analysis follows the PDF download link, attacker-controlled script could execute in the security context of the Pandora application, potentially allowing access to application data or actions using the victim's session. The patch prevents the issue by explicitly returning PDF downloads with Content-Type: ap
- Product
- pandora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 15, 2026Pandora contains a denial-of-service vulnerability in its handling of DAA (Direct Access Archive) files.CVE-2026-74767 · Other software · pandora-analysis · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8High 8.7
Pandora contains a denial-of-service vulnerability in its handling of DAA (Direct Access Archive) files. When extracting the internal ISO image from a DAA archive, compressed chunks were decompressed using zlib.decompress() without enforcing a limit on the resulting uncompressed data. An attacker able to submit a crafted DAA file containing highly compressed data could cause Pandora to decompress a relatively small input into a very large amount of data in memory. Because the decompressed chunks are accumulated to construct the internal ISO image, this could result in excessive memory consumption and potentially CPU exhaustion, causing the extraction worker to become unresponsive, terminate, or affect the availability of the Pandora service. The patch introduces bounded decompression using decompressobj().decompress() with max_extracted_filesize, verifies the cumulative size of decompressed chunks, and raises a dedicated ZipBomb exception when the configured limit is exceeded. Pandora then aborts extraction and reports the file as too large.
- Product
- pandora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 15, 2026Pandora contains a path traversal vulnerability in its TAR archive extraction functionality.CVE-2026-74764 · Other software · pandora-analysis · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8Critical 10
Pandora contains a path traversal vulnerability in its TAR archive extraction functionality. When processing a submitted TAR archive, the extractor passed archive member names directly to Python's tarfile.TarFile.extract() without applying an extraction filter. An attacker able to submit a specially crafted TAR archive containing malicious member paths, such as paths using ../ sequences or absolute paths, could cause extracted files to be written outside the intended extraction directory. This may allow the attacker to overwrite files accessible to the Pandora worker process and could potentially result in application compromise, arbitrary code execution, or denial of service depending on the files targeted and the privileges of the Pandora process. The vulnerability is corrected by using Python's filter='data' extraction filter, which rejects or sanitizes dangerous TAR members, including paths that escape the destination directory and unsafe link targets. The weakness corresponds to MITRE's general path traversal category, which includes archive extraction cases where attacker-controlled filenames cause files to be written outside the intended directory.
- Product
- pandora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via graph container parameter.CVE-2026-34187 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via graph container parameter. This issue affects Pandora FMS: from 777 through 800
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Server-Side Request Forgery vulnerability allows Privilege Escalation via API Checker extension.CVE-2026-30810 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 7.1
Server-Side Request Forgery vulnerability allows Privilege Escalation via API Checker extension. This issue affects Pandora FMS: from 777 through 800
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Session Fixation vulnerability allows Session Hijacking via crafted session ID.CVE-2026-30808 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 7.6
Session Fixation vulnerability allows Session Hijacking via crafted session ID. This issue affects Pandora FMS: from 777 through 800
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Cross-Site Request Forgery vulnerability allows an attacker to perform unauthorized actions via crafted web page.CVE-2026-30807 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 7.1
Cross-Site Request Forgery vulnerability allows an attacker to perform unauthorized actions via crafted web page. This issue affects Pandora FMS: from 777 through 800
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Insecure Default Initialization of Resource vulnerability allows Authentication Bypass via API access.CVE-2026-30805 · Other software · Pandora FMS · reported by security@pandorafms.comCritical 9.1
Insecure Default Initialization of Resource vulnerability allows Authentication Bypass via API access. This issue affects Pandora FMS: from 777 through 800
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2026Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via Event Response execution.CVE-2026-34188 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 7.5
Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via Event Response execution. This issue affects Pandora FMS: from 777 through 800
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2026Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via custom fields.CVE-2026-34186 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 8.7
Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via custom fields. This issue affects Pandora FMS: from 777 through 800
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2026Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via module search.CVE-2026-30813 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 8.7
Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via module search. This issue affects Pandora FMS: from 777 through 800
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2026Improper Neutralization of Input During Web Page Generation vulnerability allows Stored Cross-Site Scripting via event comments.CVE-2026-30812 · Other software · Pandora FMS · reported by security@pandorafms.comLow 2.1
Improper Neutralization of Input During Web Page Generation vulnerability allows Stored Cross-Site Scripting via event comments. This issue affects Pandora FMS: from 777 through 800
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2026Missing Authorization vulnerability allows Exposure of Sensitive Information via configuration endpoint.CVE-2026-30811 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 8.4
Missing Authorization vulnerability allows Exposure of Sensitive Information via configuration endpoint. This issue affects Pandora FMS: from 777 through 800
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2026Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via WebServerModuleDebug.CVE-2026-30809 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 8.7
Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via WebServerModuleDebug. This issue affects Pandora FMS: from 777 through 800
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2026Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via Network Report.CVE-2026-30806 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 8.7
Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via Network Report. This issue affects Pandora FMS: from 777 through 800
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2026Unrestricted Upload of File with Dangerous Type vulnerability allows Remote Code Execution via file upload.CVE-2026-30804 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 8.6
Unrestricted Upload of File with Dangerous Type vulnerability allows Remote Code Execution via file upload. This issue affects Pandora FMS: from 777 through 800
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2025An authentication bypass vulnerability in PandoraNext-TokensTool v0.6.8 and before.CVE-2024-50641 · Other software · reported by MITREHigh 8.1
An authentication bypass vulnerability in PandoraNext-TokensTool v0.6.8 and before. An attacker can exploit this vulnerability to access API without any token.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2025An unauthenticated remote command execution vulnerability exists in Pandora FMS versions up to and including 5.0RC1 via the Anyterm web interface, which listensCVE-2014-125124 · Other software · Artica ST · reported by VulnCheckCritical 10
An unauthenticated remote command execution vulnerability exists in Pandora FMS versions up to and including 5.0RC1 via the Anyterm web interface, which listens on TCP port 8023. The anyterm-module endpoint accepts unsanitized user input via the p parameter and directly injects it into a shell command, allowing arbitrary command execution as the pandora user. In certain versions (notably 4.1 and 5.0RC1), the pandora user can elevate privileges to root without a password using a chain involving the artica user account. This account is typically installed without a password and is configured to run sudo without authentication. Therefore, full system compromise is possible without any credentials.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comexploit-db.com
Jul 25, 2025An unauthenticated SQL injection vulnerability exists in Pandora FMS version 5.0 SP2 and earlier.CVE-2014-125115 · Other software · Artica ST · reported by VulnCheckCritical 10
An unauthenticated SQL injection vulnerability exists in Pandora FMS version 5.0 SP2 and earlier. The mobile/index.php endpoint fails to properly sanitize user input in the loginhash_data parameter, allowing attackers to extract administrator credentials or active session tokens via crafted requests. This occurs because input is directly concatenated into an SQL query without adequate validation, enabling SQL injection. After authentication is bypassed, a second vulnerability in the File Manager component permits arbitrary PHP file uploads. The file upload functionality does not enforce MIME-type or file extension restrictions, allowing authenticated users to upload web shells into a publicly accessible directory and achieve remote code execution.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comweb.archive.org
Jul 3, 2025An authenticated remote code execution vulnerability exists in Pandora FMS version 7.0NG and earlier.CVE-2025-34088 · Other software · Artica ST · reported by VulnCheckHigh 8.6
An authenticated remote code execution vulnerability exists in Pandora FMS version 7.0NG and earlier. The net_tools.php functionality allows authenticated users to execute arbitrary OS commands via the select_ips parameter when performing network tools operations, such as pinging. This occurs because user input is not properly sanitized before being passed to system commands, enabling command injection.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comraw.githubusercontent.com
Jun 27, 2025Improper Neutralization of Special Elements in the Netflow directory field may allow OS command injection.CVE-2025-5306 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 7
Improper Neutralization of Special Elements in the Netflow directory field may allow OS command injection. This issue affects Pandora FMS 774 through 778
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Improper Neutralization of Special Elements in the chromium_path variable may allow OS command injection.CVE-2025-4678 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 7
Improper Neutralization of Special Elements in the chromium_path variable may allow OS command injection. This issue affects Pandora ITSM 5.0.105.
- Product
- Pandora ITSM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Improper Neutralization of Special Elements in the backup name field may allow OS command injection.CVE-2025-4653 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 7
Improper Neutralization of Special Elements in the backup name field may allow OS command injection. This issue affects Pandora ITSM 5.0.105.
- Product
- Pandora ITSM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2025Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection via RCE.CVE-2024-12992 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 8.6
Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection via RCE. This issue affects Pandora FMS from 700 to 777.6 .
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2025Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection.This issue affects Pandora FMS from 700 to 777.6CVE-2024-12971 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 8.6
Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection.This issue affects Pandora FMS from 700 to 777.6
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2024Arbitrary commands execution on the server by exploiting a command injection vulnerability in the LDAP authentication mechanism.CVE-2024-11320 · Other software · Pandora FMS · reported by security@pandorafms.comMedium 6.9
Arbitrary commands execution on the server by exploiting a command injection vulnerability in the LDAP authentication mechanism. This issue affects Pandora FMS: from 700 through <=777.4
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2024A post-authentication SQL Injection vulnerability within the filters parameter of the extensions/agents_modules_csv functionality.CVE-2024-9987 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 8.6
A post-authentication SQL Injection vulnerability within the filters parameter of the extensions/agents_modules_csv functionality. This issue affects Pandora FMS: from 700 through <777.3.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2024A post-authentication arbitrary file read vulnerability within the server plugins section in plugin edition feature.CVE-2024-35308 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 8.3
A post-authentication arbitrary file read vulnerability within the server plugins section in plugin edition feature. This issue affects Pandora FMS: from 700 through <777.3.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2024A segmentation fault in KMPlayer v4.2.2.65 allows attackers to cause a Denial of Service (DoS) via a crafted AVI file.CVE-2024-41200 · Other software · Pandora · reported by MITREMedium 5.5
A segmentation fault in KMPlayer v4.2.2.65 allows attackers to cause a Denial of Service (DoS) via a crafted AVI file.
- Product
- Kmplayer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2024Argument Injection Leading to Remote Code Execution in Realtime Graph Extension, allowing unauthenticated attackers to execute arbitrary code on the server.CVE-2024-35307 · Other software · Pandora FMS · reported by security@pandorafms.comCritical 9.4
Argument Injection Leading to Remote Code Execution in Realtime Graph Extension, allowing unauthenticated attackers to execute arbitrary code on the server. This issue affects Pandora FMS: from 700 through <777.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpandorafms.compandorafms.com
Jun 10, 2024OS Command injection in Ajax PHP files via HTTP Request, allows to execute system commands by exploiting variables.CVE-2024-35306 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 8.7
OS Command injection in Ajax PHP files via HTTP Request, allows to execute system commands by exploiting variables. This issue affects Pandora FMS: from 700 through <777.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpandorafms.compandorafms.com
Jun 10, 2024Unauth Time-Based SQL Injection in API allows to exploit HTTP request Authorization header.CVE-2024-35305 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 8.9
Unauth Time-Based SQL Injection in API allows to exploit HTTP request Authorization header. This issue affects Pandora FMS: from 700 through <777.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpandorafms.compandorafms.com
Jun 10, 2024System command injection through Netflow function due to improper input validation, allowing attackers to execute arbitrary system commands.CVE-2024-35304 · Other software · Pandora FMS · reported by security@pandorafms.comCritical 9.3
System command injection through Netflow function due to improper input validation, allowing attackers to execute arbitrary system commands. This issue affects Pandora FMS: from 700 through <777.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpandorafms.compandorafms.com
Mar 19, 2024Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Pandora FMS on all allows OS Command Injection.CVE-2023-44092 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 7.6
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Pandora FMS on all allows OS Command Injection. This vulnerability allowed to create a reverse shell and execute commands in the OS. This issue affects Pandora FMS: from 700 through <776.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpandorafms.compandorafms.com
Mar 19, 2024Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows SQL Injection.CVE-2023-44091 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 7.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows SQL Injection. This ulnerability allowed SQL injections to be made even if authentication failed.This issue affects Pandora FMS: from 700 through <776.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpandorafms.compandorafms.com
Mar 19, 2024 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows CVE-2008-5817.CVE-2023-44090 · Other software · Pandora FMS · reported by security@pandorafms.comMedium 6.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows CVE-2008-5817. This vulnerability allowed SQL changes to be made to several files in the Grafana module. This issue affects Pandora FMS: from 700 through <776.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpandorafms.compandorafms.com
Mar 19, 2024: Path Traversal vulnerability in Pandora FMS on all allows Path Traversal.CVE-2023-41793 · Other software · Pandora FMS · reported by security@pandorafms.comMedium 6.7
: Path Traversal vulnerability in Pandora FMS on all allows Path Traversal. This vulnerability allowed changing directories and creating files and downloading them outside the allowed directories. This issue affects Pandora FMS: from 700 through <776.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpandorafms.compandorafms.com
Dec 29, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS).CVE-2023-44089 · Other software · Pandora FMS · reported by security@pandorafms.comMedium 6.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). It was possible to execute malicious JS code on Visual Consoles. This issue affects Pandora FMS: from 700 through 774.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpandorafms.compandorafms.com
Dec 29, 2023Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows SQL Injection.CVE-2023-44088 · Other software · Pandora FMS · reported by security@pandorafms.comMedium 5.9
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows SQL Injection. Arbitrary SQL queries were allowed to be executed using any account with low privileges. This issue affects Pandora FMS: from 700 through 774.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpandorafms.compandorafms.com
Dec 29, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS).CVE-2023-41815 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 7.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Malicious code could be executed in the File Manager section. This issue affects Pandora FMS: from 700 through 774.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpandorafms.compandorafms.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.