CVE Program partner

PandoraFMS

Pandora FMS

API
CVEs, 365 days2156 all time, 0 rejected
Quality100%median 99%
CVSS by the CNA100%share of records
CWE100%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA0%lower is better
OrganisationPandora FMS
RoleCNA
TypeVendor
Reports toINCIBE → mitre
ScopePandora FMS, Pandora ITSM, and Pandora RC issues only.
Advisorieshttps://pandorafms.com/common-vulnerabilities-and-exposures/

Latest CVEs · RSS

  • CVE-2026-75786 2026-10-01 · CVSS 7.2
    Unsanitized concatenation of the module parameter in the Grafana datasource endpoint allows authenticated blind SQL injection. Affects Pandora FMS from 777 onwa
  • CVE-2026-64950 2026-10-01 · CVSS 8.4
    Missing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows stored XSS, executing without user intera
  • CVE-2026-64949 2026-10-01 · CVSS 8.6
    Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files. Affects Pandora FMS from 777 onwar
  • CVE-2026-64948 2026-10-01 · CVSS 7.1
    Missing authorization in module data retrieval allows unauthorized cross-group access to module history. Affects Pandora FMS from 777 onwards.
  • CVE-2026-64947 2026-10-01 · CVSS 7.5
    A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP code, resulti
  • CVE-2026-64946 2026-10-01 · CVSS 7.4
    A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltratio
  • CVE-2026-34190 2026-10-01 · CVSS 5.9
    Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of alert commands via sequential, unvalidated GET requests when an authenticated ad
  • CVE-2026-34189 2026-10-01 · CVSS 5.9
    Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of event responses via a forged GET request when an authenticated administrator vis
  • CVE-2026-34187 2026-05-12 · CVSS 7.6
    Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via graph container parameter. This issue affects Pandora
  • CVE-2026-30810 2026-05-12 · CVSS 7.1
    Server-Side Request Forgery vulnerability allows Privilege Escalation via API Checker extension. This issue affects Pandora FMS: from 777 through 800
  • CVE-2026-30808 2026-05-12 · CVSS 7.6
    Session Fixation vulnerability allows Session Hijacking via crafted session ID. This issue affects Pandora FMS: from 777 through 800
  • CVE-2026-30807 2026-05-12 · CVSS 7.1
    Cross-Site Request Forgery vulnerability allows an attacker to perform unauthorized actions via crafted web page. This issue affects Pandora FMS: from 777 throu
  • CVE-2026-30805 2026-05-12 · CVSS 9.1
    Insecure Default Initialization of Resource vulnerability allows Authentication Bypass via API access. This issue affects Pandora FMS: from 777 through 800
  • CVE-2026-34188 2026-04-13 · CVSS 7.5
    Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via Event Response execution. This issue affects Pan
  • CVE-2026-34186 2026-04-13 · CVSS 8.7
    Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via custom fields. This issue affects Pandora FMS: from 77
  • CVE-2026-30813 2026-04-13 · CVSS 8.7
    Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via module search. This issue affects Pandora FMS: from 77
  • CVE-2026-30812 2026-04-13 · CVSS 2.1
    Improper Neutralization of Input During Web Page Generation vulnerability allows Stored Cross-Site Scripting via event comments. This issue affects Pandora FMS:
  • CVE-2026-30811 2026-04-13 · CVSS 8.4
    Missing Authorization vulnerability allows Exposure of Sensitive Information via configuration endpoint. This issue affects Pandora FMS: from 777 through 800
  • CVE-2026-30809 2026-04-13 · CVSS 8.7
    Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via WebServerModuleDebug. This issue affects Pandora
  • CVE-2026-30806 2026-04-13 · CVSS 8.7
    Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via Network Report. This issue affects Pandora FMS:
  • CVE-2026-30804 2026-04-13 · CVSS 8.6
    Unrestricted Upload of File with Dangerous Type vulnerability allows Remote Code Execution via file upload. This issue affects Pandora FMS: from 777 through 800
  • CVE-2025-5306 2025-06-27 · CVSS 7.0
    Improper Neutralization of Special Elements in the Netflow directory field may allow OS command injection. This issue affects Pandora FMS 774 through 778
  • CVE-2025-4678 2025-06-10 · CVSS 7.0
    Improper Neutralization of Special Elements in the chromium_path variable may allow OS command injection. This issue affects Pandora ITSM 5.0.105.
  • CVE-2025-4653 2025-06-10 · CVSS 7.0
    Improper Neutralization of Special Elements in the backup name field may allow OS command injection. This issue affects Pandora ITSM 5.0.105.
  • CVE-2024-12992 2025-03-17 · CVSS 8.6
    Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection via RCE. This issue affects Pandora FMS from 700 to 77

All CVE Program partners