Pandorafms

CVEs (78)

• CVE-2026-30807HigMay 12, 2026
  Pandora

  Pandora
  risk 0.57cvss 8.8epss 0.00

  Cross-Site Request Forgery vulnerability allows an attacker to perform unauthorized actions via crafted web page. This issue affects Pandora FMS: from 777 through 800

• CVE-2026-34186HigApr 13, 2026
  Pandora

  Pandora
  risk 0.57cvss 8.8epss 0.00

  Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via custom fields. This issue affects Pandora FMS: from 777 through 800

• CVE-2026-30813HigApr 13, 2026
  Pandora

  Pandora
  risk 0.57cvss 8.8epss 0.00

  Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via module search. This issue affects Pandora FMS: from 777 through 800

• CVE-2026-30809HigApr 13, 2026
  Pandora

  Pandora
  risk 0.57cvss 8.8epss 0.01

  Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via WebServerModuleDebug. This issue affects Pandora FMS: from 777 through 800

• CVE-2026-30806HigApr 13, 2026
  Pandora

  Pandora
  risk 0.57cvss 8.8epss 0.01

  Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via Network Report. This issue affects Pandora FMS: from 777 through 800

• CVE-2023-41808HigNov 23, 2023
  Pandora

  Pandora
  risk 0.55cvss 8.5epss 0.01

  Improper Privilege Management vulnerability in Pandora FMS on all allows Privilege Escalation. This vulnerability allows an unauthorised user to escalate and read sensitive files as if they were root. This issue affects Pandora FMS: from 700 through 773.

• CVE-2023-41791HigNov 23, 2023
  Pandora

  Pandora
  risk 0.55cvss 8.4epss 0.00

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). This vulnerability allowed users with low privileges to introduce Javascript executables via a translation string that…

• CVE-2026-30808HigMay 12, 2026
  Pandora

  Pandora
  risk 0.53cvss 8.1epss 0.00

  Session Fixation vulnerability allows Session Hijacking via crafted session ID. This issue affects Pandora FMS: from 777 through 800

• CVE-2023-41806HigNov 23, 2023
  Pandora

  Pandora
  risk 0.53cvss 8.2epss 0.00

  Improper Privilege Management vulnerability in Pandora FMS on all allows Privilege Escalation. This vulnerability causes that a bad privilege assignment could cause a DOS attack that affects the availability of the Pandora FMS server. This issue affects Pandora FMS: from 700…

• CVE-2020-5844HigMar 16, 2020
  Pandora

  Pandora
  risk 0.52cvss 7.2epss 0.30

  index.php?sec=godmode/extensions&sec2=extensions/files_repo in Pandora FMS v7.0 NG allows authenticated administrators to upload malicious PHP scripts, and execute them via base64 decoding of the file location. This affects v7.0NG.742_FIX_PERL2020.

• CVE-2020-8947HigFeb 12, 2020
  Artica

  Pandorafms
  risk 0.52cvss 7.2epss 0.22

  functions_netflow.php in Artica Pandora FMS 7.0 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the index.php?operation/netflow/nf_live_view ip_dst, dst_port, or src_port parameter, a different vulnerability than CVE-2019-20224.

• CVE-2019-13035HigJun 29, 2019
  Pandorafms

  Pandorafms
  risk 0.51cvss 7.8epss 0.00

  Artica Pandora FMS 7.0 NG before 735 suffers from local privilege escalation due to improper permissions on C:\PandoraFMS and its sub-folders, allowing standard users to create new files. Moreover, the Apache service httpd.exe will try to execute cmd.exe from C:\PandoraFMS (the…

• CVE-2023-44092HigMar 19, 2024
  Pandora

  Pandora
  risk 0.49cvss 7.6epss 0.01

  Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Pandora FMS on all allows OS Command Injection. This vulnerability allowed to create a reverse shell and execute commands in the OS. This issue affects Pandora FMS: from…

• CVE-2023-44091HigMar 19, 2024
  Pandora

  Pandora
  risk 0.49cvss 7.5epss 0.00

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows SQL Injection. This ulnerability allowed SQL injections to be made even if authentication failed.This issue affects Pandora FMS: from 700 through <776.

• CVE-2023-41790HigNov 23, 2023
  Pandora

  Pandora
  risk 0.49cvss 7.6epss 0.01

  Uncontrolled Search Path Element vulnerability in Pandora FMS on all allows Leveraging/Manipulating Configuration File Search Paths. This vulnerability allows to access the server configuration file and to compromise the database. This issue affects Pandora FMS: from 700 through…

• CVE-2023-41789HigNov 23, 2023
  Pandora

  Pandora
  risk 0.49cvss 7.6epss 0.00

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). This vulnerability allows an attacker to perform cookie hijacking and log in as that user without the need for credentials.…

• CVE-2023-41788HigNov 23, 2023
  Pandora

  Pandora
  risk 0.49cvss 7.6epss 0.01

  Unrestricted Upload of File with Dangerous Type vulnerability in Pandora FMS on all allows Accessing Functionality Not Properly Constrained by ACLs. This vulnerability allows attackers to execute code via PHP file uploads. This issue affects Pandora FMS: from 700 through 773.

• CVE-2020-13855HigJun 11, 2020
  Artica

  Pandorafms
  risk 0.49cvss 7.2epss 0.28

  Artica Pandora FMS 7.44 allows arbitrary file upload (leading to remote command execution) via the File Repository Manager feature.

• CVE-2020-13852HigJun 11, 2020
  CoreSecurity

  Pandora FMS
  risk 0.49cvss 7.2epss 0.28

  Artica Pandora FMS 7.44 allows arbitrary file upload (leading to remote command execution) via the File Manager feature.

• CVE-2020-13850HigJun 11, 2020
  Artica

  Pandorafms
  risk 0.49cvss 7.5epss 0.02

  Artica Pandora FMS 7.44 has inadequate access controls on a web folder.