CVE-2026-34187 | Critical | 9.8 | 2026-05-12 | Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via graph container parameter. This issue affects Pandora… |
CVE-2026-30810 | High | 8.8 | 2026-05-12 | Server-Side Request Forgery vulnerability allows Privilege Escalation via API Checker extension. This issue affects Pandora FMS: from 777 through 800 |
CVE-2026-30808 | High | 8.1 | 2026-05-12 | Session Fixation vulnerability allows Session Hijacking via crafted session ID. This issue affects Pandora FMS: from 777 through 800 |
CVE-2026-30807 | High | 8.8 | 2026-05-12 | Cross-Site Request Forgery vulnerability allows an attacker to perform unauthorized actions via crafted web page. This issue affects Pandora FMS: from 777 thro… |
CVE-2026-30805 | Critical | 9.1 | 2026-05-12 | Insecure Default Initialization of Resource vulnerability allows Authentication Bypass via API access. This issue affects Pandora FMS: from 777 through 800 |
CVE-2026-34188 | High | 7.2 | 2026-04-13 | Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via Event Response execution. This issue affects Pa… |
CVE-2026-34186 | High | 8.8 | 2026-04-13 | Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via custom fields. This issue affects Pandora FMS: from 7… |
CVE-2026-30813 | High | 8.8 | 2026-04-13 | Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via module search. This issue affects Pandora FMS: from 7… |
CVE-2026-30812 | Medium | 5.4 | 2026-04-13 | Improper Neutralization of Input During Web Page Generation vulnerability allows Stored Cross-Site Scripting via event comments. This issue affects Pandora FMS… |
CVE-2026-30811 | Medium | 6.5 | 2026-04-13 | Missing Authorization vulnerability allows Exposure of Sensitive Information via configuration endpoint. This issue affects Pandora FMS: from 777 through 800 |
CVE-2026-30809 | High | 8.8 | 2026-04-13 | Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via WebServerModuleDebug. This issue affects Pandor… |
CVE-2026-30806 | High | 8.8 | 2026-04-13 | Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via Network Report. This issue affects Pandora FMS… |
CVE-2026-30804 | High | 7.2 | 2026-04-13 | Unrestricted Upload of File with Dangerous Type vulnerability allows Remote Code Execution via file upload. This issue affects Pandora FMS: from 777 through 800 |
CVE-2025-5306 | Critical | 9.8 | 2025-06-27 | Improper Neutralization of Special Elements in the Netflow directory field may allow OS command injection. This issue affects Pandora FMS 774 through 778 |
CVE-2025-4678 | | | 2025-06-10 | Improper Neutralization of Special Elements in the chromium_path variable may allow OS command injection. This issue affects Pandora ITSM 5.0.105. |
CVE-2025-4653 | | | 2025-06-10 | Improper Neutralization of Special Elements in the backup name field may allow OS command injection. This issue affects Pandora ITSM 5.0.105. |
CVE-2024-12992 | Critical | 9.8 | 2025-03-17 | Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection via RCE.
This issue affects Pandora FMS from 700 to 7… |
CVE-2024-12971 | High | 8.8 | 2025-03-17 | Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection.This issue affects Pandora FMS from 700 to 777.6 |
CVE-2024-11320 | Critical | 9.8 | 2024-11-21 | Arbitrary commands execution on the server by exploiting a command injection vulnerability in the LDAP authentication mechanism. This issue affects Pandora FMS… |
CVE-2024-9987 | High | 8.8 | 2024-10-22 | A post-authentication SQL Injection vulnerability within the filters parameter of the extensions/agents_modules_csv functionality. This issue affects Pandora F… |
CVE-2024-35308 | High | 8.8 | 2024-10-22 | A post-authentication arbitrary file read vulnerability within the server plugins section in plugin edition feature. This issue affects Pandora FMS: from 700 t… |
CVE-2024-35307 | Critical | 9.8 | 2024-06-10 | Argument Injection Leading to Remote Code Execution in Realtime Graph Extension, allowing unauthenticated attackers to execute arbitrary code on the server. Th… |
CVE-2024-35306 | Critical | 9.8 | 2024-06-10 | OS Command injection in Ajax PHP files via HTTP Request, allows to execute system commands by exploiting variables. This issue affects Pandora FMS: from 700 th… |
CVE-2024-35305 | Critical | 9.8 | 2024-06-10 | Unauth Time-Based SQL Injection in API allows to exploit HTTP request Authorization header. This issue affects Pandora FMS: from 700 through <777. |
CVE-2024-35304 | Critical | 9.8 | 2024-06-10 | System command injection through Netflow function due to improper input validation, allowing attackers to execute arbitrary system commands. This issue affects… |
CVE-2023-44092 | High | 7.6 | 2024-03-19 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Pandora FMS on all allows OS Command Injection. Thi… |
CVE-2023-44091 | High | 7.5 | 2024-03-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows SQL Injection. This ulnerabilit… |
CVE-2023-44090 | Medium | 6.8 | 2024-03-19 |
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows CVE-2008-5817. This vulnerabil… |
CVE-2023-41793 | Medium | 6.7 | 2024-03-19 | : Path Traversal vulnerability in Pandora FMS on all allows Path Traversal. This vulnerability allowed changing directories and creating files and downloading… |
CVE-2023-44089 | Medium | 6.1 | 2023-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). It… |
CVE-2023-44088 | Medium | 5.9 | 2023-12-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows SQL Injection. Arbitrary SQL qu… |
CVE-2023-41815 | High | 7.5 | 2023-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Mal… |
CVE-2023-41814 | Low | 3.7 | 2023-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Thr… |
CVE-2023-41813 | Low | 3.0 | 2023-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). All… |
CVE-2023-4677 | High | 7.0 | 2023-11-23 | Cron log backup files contain administrator session IDs. It is trivial for any attacker who can reach the Pandora FMS Console to scrape the cron logs directory… |
CVE-2023-41812 | Medium | 5.7 | 2023-11-23 | Unrestricted Upload of File with Dangerous Type vulnerability in Pandora FMS on all allows Accessing Functionality Not Properly Constrained by ACLs. This vulne… |
CVE-2023-41811 | Medium | 5.3 | 2023-11-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Thi… |
CVE-2023-41810 | Medium | 4.0 | 2023-11-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Thi… |
CVE-2023-41808 | High | 8.5 | 2023-11-23 | Improper Privilege Management vulnerability in Pandora FMS on all allows Privilege Escalation. This vulnerability allows an unauthorised user to escalate and r… |
CVE-2023-41807 | Critical | 9.1 | 2023-11-23 | Improper Privilege Management vulnerability in Pandora FMS on all allows Privilege Escalation. This vulnerability allows a user to escalate permissions on the… |
CVE-2023-41806 | High | 8.2 | 2023-11-23 | Improper Privilege Management vulnerability in Pandora FMS on all allows Privilege Escalation. This vulnerability causes that a bad privilege assignment could… |
CVE-2023-41792 | Medium | 5.9 | 2023-11-23 | Cross-Site Request Forgery (CSRF) vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). This vulnerability allowed Javascript code to be execu… |
CVE-2023-41791 | High | 8.4 | 2023-11-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Thi… |
CVE-2023-41790 | High | 7.6 | 2023-11-23 | Uncontrolled Search Path Element vulnerability in Pandora FMS on all allows Leveraging/Manipulating Configuration File Search Paths. This vulnerability allows… |
CVE-2023-41789 | High | 7.6 | 2023-11-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Thi… |
CVE-2023-41788 | High | 7.6 | 2023-11-23 | Unrestricted Upload of File with Dangerous Type vulnerability in Pandora FMS on all allows Accessing Functionality Not Properly Constrained by ACLs. This vulne… |
CVE-2023-41787 | Medium | 6.0 | 2023-11-23 | Uncontrolled Search Path Element vulnerability in Pandora FMS on all allows Leveraging/Manipulating Configuration File Search Paths. This vulnerability allows… |
CVE-2023-41786 | Medium | 6.8 | 2023-11-23 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pandora FMS on all allows File Discovery. This vulnerability allows users with low… |