CVE-2026-34187 | Critical | 9.8 | 2026-05-12 | Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via graph container parameter. This issue affects Pandora… |
CVE-2026-30810 | High | 8.8 | 2026-05-12 | Server-Side Request Forgery vulnerability allows Privilege Escalation via API Checker extension. This issue affects Pandora FMS: from 777 through 800 |
CVE-2026-30808 | High | 8.1 | 2026-05-12 | Session Fixation vulnerability allows Session Hijacking via crafted session ID. This issue affects Pandora FMS: from 777 through 800 |
CVE-2026-30807 | High | 8.8 | 2026-05-12 | Cross-Site Request Forgery vulnerability allows an attacker to perform unauthorized actions via crafted web page. This issue affects Pandora FMS: from 777 thro… |
CVE-2026-30805 | Critical | 9.1 | 2026-05-12 | Insecure Default Initialization of Resource vulnerability allows Authentication Bypass via API access. This issue affects Pandora FMS: from 777 through 800 |
CVE-2026-34188 | High | 7.2 | 2026-04-13 | Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via Event Response execution. This issue affects Pa… |
CVE-2026-34186 | High | 8.8 | 2026-04-13 | Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via custom fields. This issue affects Pandora FMS: from 7… |
CVE-2026-30813 | High | 8.8 | 2026-04-13 | Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via module search. This issue affects Pandora FMS: from 7… |
CVE-2026-30812 | Medium | 5.4 | 2026-04-13 | Improper Neutralization of Input During Web Page Generation vulnerability allows Stored Cross-Site Scripting via event comments. This issue affects Pandora FMS… |
CVE-2026-30811 | Medium | 6.5 | 2026-04-13 | Missing Authorization vulnerability allows Exposure of Sensitive Information via configuration endpoint. This issue affects Pandora FMS: from 777 through 800 |
CVE-2026-30809 | High | 8.8 | 2026-04-13 | Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via WebServerModuleDebug. This issue affects Pandor… |
CVE-2026-30806 | High | 8.8 | 2026-04-13 | Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via Network Report. This issue affects Pandora FMS… |
CVE-2026-30804 | High | 7.2 | 2026-04-13 | Unrestricted Upload of File with Dangerous Type vulnerability allows Remote Code Execution via file upload. This issue affects Pandora FMS: from 777 through 800 |
CVE-2025-5306 | Critical | 9.8 | 2025-06-27 | Improper Neutralization of Special Elements in the Netflow directory field may allow OS command injection. This issue affects Pandora FMS 774 through 778 |
CVE-2024-12992 | Critical | 9.8 | 2025-03-17 | Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection via RCE.
This issue affects Pandora FMS from 700 to 7… |
CVE-2024-12971 | High | 8.8 | 2025-03-17 | Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection.This issue affects Pandora FMS from 700 to 777.6 |
CVE-2024-35307 | Critical | 9.8 | 2024-06-10 | Argument Injection Leading to Remote Code Execution in Realtime Graph Extension, allowing unauthenticated attackers to execute arbitrary code on the server. Th… |
CVE-2024-35306 | Critical | 9.8 | 2024-06-10 | OS Command injection in Ajax PHP files via HTTP Request, allows to execute system commands by exploiting variables. This issue affects Pandora FMS: from 700 th… |
CVE-2024-35305 | Critical | 9.8 | 2024-06-10 | Unauth Time-Based SQL Injection in API allows to exploit HTTP request Authorization header. This issue affects Pandora FMS: from 700 through <777. |
CVE-2024-35304 | Critical | 9.8 | 2024-06-10 | System command injection through Netflow function due to improper input validation, allowing attackers to execute arbitrary system commands. This issue affects… |
CVE-2023-44092 | High | 7.6 | 2024-03-19 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Pandora FMS on all allows OS Command Injection. Thi… |
CVE-2023-44091 | High | 7.5 | 2024-03-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows SQL Injection. This ulnerabilit… |
CVE-2023-44090 | Medium | 6.8 | 2024-03-19 |
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows CVE-2008-5817. This vulnerabil… |
CVE-2023-41793 | Medium | 6.7 | 2024-03-19 | : Path Traversal vulnerability in Pandora FMS on all allows Path Traversal. This vulnerability allowed changing directories and creating files and downloading… |
CVE-2023-4677 | High | 7.0 | 2023-11-23 | Cron log backup files contain administrator session IDs. It is trivial for any attacker who can reach the Pandora FMS Console to scrape the cron logs directory… |
CVE-2023-41812 | Medium | 5.7 | 2023-11-23 | Unrestricted Upload of File with Dangerous Type vulnerability in Pandora FMS on all allows Accessing Functionality Not Properly Constrained by ACLs. This vulne… |
CVE-2023-41811 | Medium | 5.3 | 2023-11-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Thi… |
CVE-2023-41810 | Medium | 4.0 | 2023-11-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Thi… |
CVE-2023-41808 | High | 8.5 | 2023-11-23 | Improper Privilege Management vulnerability in Pandora FMS on all allows Privilege Escalation. This vulnerability allows an unauthorised user to escalate and r… |
CVE-2023-41807 | Critical | 9.1 | 2023-11-23 | Improper Privilege Management vulnerability in Pandora FMS on all allows Privilege Escalation. This vulnerability allows a user to escalate permissions on the… |
CVE-2023-41806 | High | 8.2 | 2023-11-23 | Improper Privilege Management vulnerability in Pandora FMS on all allows Privilege Escalation. This vulnerability causes that a bad privilege assignment could… |
CVE-2023-41792 | Medium | 5.9 | 2023-11-23 | Cross-Site Request Forgery (CSRF) vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). This vulnerability allowed Javascript code to be execu… |
CVE-2023-41791 | High | 8.4 | 2023-11-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Thi… |
CVE-2023-41790 | High | 7.6 | 2023-11-23 | Uncontrolled Search Path Element vulnerability in Pandora FMS on all allows Leveraging/Manipulating Configuration File Search Paths. This vulnerability allows… |
CVE-2023-41789 | High | 7.6 | 2023-11-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Thi… |
CVE-2023-41788 | High | 7.6 | 2023-11-23 | Unrestricted Upload of File with Dangerous Type vulnerability in Pandora FMS on all allows Accessing Functionality Not Properly Constrained by ACLs. This vulne… |
CVE-2023-41787 | Medium | 6.0 | 2023-11-23 | Uncontrolled Search Path Element vulnerability in Pandora FMS on all allows Leveraging/Manipulating Configuration File Search Paths. This vulnerability allows… |
CVE-2023-41786 | Medium | 6.8 | 2023-11-23 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pandora FMS on all allows File Discovery. This vulnerability allows users with low… |
CVE-2021-46681 | Medium | 4.0 | 2022-08-05 | A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via module massive operation name… |
CVE-2021-36698 | Medium | 5.4 | 2021-11-03 | Pandora FMS through 755 allows XSS via a new Event Filter with a crafted name. |
CVE-2021-36697 | Medium | 6.7 | 2021-11-03 | With an admin account, the .htaccess file in Artica Pandora FMS <=755 can be overwritten with the File Manager component. The new .htaccess file contains a Rew… |
CVE-2021-3834 | Medium | 5.4 | 2021-10-07 | Integria IMS in its 5.0.92 version does not filter correctly some fields related to the login.php file. An attacker could exploit this vulnerability in order t… |
CVE-2021-3833 | Critical | 9.8 | 2021-10-07 | Integria IMS login check uses a loose comparator ("==") to compare the MD5 hash of the password provided by the user and the MD5 hash stored in the database. A… |
CVE-2021-3832 | Critical | 9.8 | 2021-10-07 | Integria IMS in its 5.0.92 version is vulnerable to a Remote Code Execution attack through file uploading. An unauthenticated attacker could abuse the AsyncUpl… |
CVE-2021-34075 | Medium | 5.9 | 2021-06-30 | In Artica Pandora FMS <=754 in the File Manager component, there is sensitive information exposed on the client side which attackers can access. |
CVE-2021-32100 | Medium | 6.5 | 2021-05-07 | A remote file inclusion vulnerability exists in Artica Pandora FMS 742, exploitable by the lowest privileged user. |
CVE-2021-32099 | Critical | 9.8 | 2021-05-07 | A SQL injection vulnerability in the pandora_console component of Artica Pandora FMS 742 allows an unauthenticated attacker to upgrade his unprivileged session… |
CVE-2021-32098 | Critical | 9.8 | 2021-05-07 | Artica Pandora FMS 742 allows unauthenticated attackers to perform Phar deserialization. |
CVE-2020-26518 | Critical | 9.8 | 2020-10-02 | Artica Pandora FMS before 743 allows unauthenticated attackers to conduct SQL injection attacks via the pandora_console/include/chart_generator.php session_id… |
CVE-2020-8511 | High | 7.2 | 2020-03-23 | In Artica Pandora FMS through 7.42, Web Admin users can execute arbitrary code by uploading a .php file via the File Repository component, a different issue th… |
CVE-2020-7935 | High | 7.2 | 2020-03-23 | Artica Pandora FMS through 7.42 is vulnerable to remote PHP code execution because of an Unrestricted Upload Of A File With A Dangerous Type issue in the File… |
CVE-2020-8497 | Medium | 5.3 | 2020-03-23 | In Artica Pandora FMS through 7.42, an unauthenticated attacker can read the chat history. The file is in JSON format and it contains user names, user IDs, pri… |
CVE-2020-5844 | High | 7.2 | 2020-03-16 | index.php?sec=godmode/extensions&sec2=extensions/files_repo in Pandora FMS v7.0 NG allows authenticated administrators to upload malicious PHP scripts, and exe… |
CVE-2020-8500 | High | 7.2 | 2020-03-02 | In Artica Pandora FMS 7.42, Web Admin users can execute arbitrary code by uploading a .php file via the Updater or Extension component. NOTE: The vendor report… |
CVE-2020-8947 | High | 7.2 | 2020-02-12 | functions_netflow.php in Artica Pandora FMS 7.0 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the index.php?operation/ne… |
CVE-2019-20050 | Medium | 6.8 | 2020-01-30 | Pandora FMS ≤ 7.42 suffers from a remote code execution vulnerability. To exploit the vulnerability, an authenticated user should create a new folder with a "t… |
CVE-2019-20224 | High | 8.8 | 2020-01-09 | netflow_get_stats in functions_netflow.php in Pandora FMS 7.0NG allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in… |
CVE-2019-19681 | High | 8.8 | 2019-12-26 | Pandora FMS 7.x suffers from remote code execution vulnerability. With an authenticated user who can modify the alert system, it is possible to define and exec… |
CVE-2019-15091 | Critical | 9.8 | 2019-08-16 | filemgr.php in Artica Integria IMS 5.0.86 allows index.php?sec=wiki&sec2=operation/wiki/wiki&action=upload arbitrary file upload. |
CVE-2018-1000812 | High | 8.1 | 2018-12-20 | Artica Integria IMS version 5.0 MR56 Package 58, likely earlier versions contains a CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerabil… |
CVE-2018-19829 | Medium | 6.5 | 2018-12-18 | Artica Integria IMS 5.0.83 has CSRF in godmode/usuarios/lista_usuarios, resulting in the ability to delete an arbitrary user when the ID number is known. |
CVE-2018-19828 | Medium | 6.1 | 2018-12-17 | Artica Integria IMS 5.0.83 has XSS via the search_string parameter. |
CVE-2018-11222 | High | 7.5 | 2018-06-16 | Local File Inclusion (LFI) in Artica Pandora FMS through version 7.23 allows an attacker to call any php file via the /pandora_console/ajax.php ajax endpoint. |
CVE-2018-11221 | Critical | 9.8 | 2018-06-16 | Unauthenticated untrusted file upload in Artica Pandora FMS through version 7.23 allows an attacker to upload an arbitrary plugin via include/ajax/update_manag… |
CVE-2017-15937 | Medium | 6.5 | 2017-10-27 | Artica Pandora FMS version 7.0 leaks a full installation pathname via GET data when intercepting the main page's graph requisition. This also implies that gene… |
CVE-2017-15936 | Medium | 5.4 | 2017-10-27 | In Artica Pandora FMS version 7.0, an Attacker with write Permission can create an agent with an XSS Payload; when a user enters the agent definitions page, th… |
CVE-2017-15935 | High | 7.2 | 2017-10-27 | Artica Pandora FMS version 7.0 is vulnerable to remote PHP code execution through the manager files function. This is only exploitable by administrators who up… |
CVE-2017-15934 | Medium | 5.4 | 2017-10-27 | Artica Pandora FMS version 7.0 is vulnerable to stored Cross-Site Scripting in the map name parameter. |
CVE-2010-4283 | | | 2010-12-02 | PHP remote file inclusion vulnerability in extras/pandora_diag.php in Pandora FMS before 3.1.1 allows remote attackers to execute arbitrary PHP code via a URL… |
CVE-2010-4282 | | | 2010-12-02 | Multiple directory traversal vulnerabilities in Pandora FMS before 3.1.1 allow remote attackers to include and execute arbitrary local files via (1) the page p… |
CVE-2010-4281 | | | 2010-12-02 | Incomplete blacklist vulnerability in the safe_url_extraclean function in ajax.php in Pandora FMS before 3.1.1 allows remote attackers to execute arbitrary PHP… |
CVE-2010-4280 | | | 2010-12-02 | Multiple SQL injection vulnerabilities in Pandora FMS before 3.1.1 allow remote authenticated users to execute arbitrary SQL commands via (1) the id_group para… |
CVE-2010-4279 | | | 2010-12-02 | The default configuration of Pandora FMS 3.1 and earlier specifies an empty string for the loginhash_pwd field, which allows remote attackers to bypass authent… |
CVE-2010-4278 | | | 2010-12-02 | operation/agentes/networkmap.php in Pandora FMS before 3.1.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the la… |