CVE-2025-34088 | High | 8.8 | 2025-07-03 | An authenticated remote code execution vulnerability exists in Pandora FMS version 7.0NG and earlier. The net_tools.php functionality allows authenticated user… |
CVE-2024-11320 | Critical | 9.8 | 2024-11-21 | Arbitrary commands execution on the server by exploiting a command injection vulnerability in the LDAP authentication mechanism. This issue affects Pandora FMS… |
CVE-2024-9987 | High | 8.8 | 2024-10-22 | A post-authentication SQL Injection vulnerability within the filters parameter of the extensions/agents_modules_csv functionality. This issue affects Pandora F… |
CVE-2024-35308 | High | 8.8 | 2024-10-22 | A post-authentication arbitrary file read vulnerability within the server plugins section in plugin edition feature. This issue affects Pandora FMS: from 700 t… |
CVE-2023-44089 | Medium | 6.1 | 2023-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). It… |
CVE-2023-44088 | Medium | 5.9 | 2023-12-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows SQL Injection. Arbitrary SQL qu… |
CVE-2023-41815 | High | 7.5 | 2023-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Mal… |
CVE-2023-41814 | Low | 3.7 | 2023-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Thr… |
CVE-2023-41813 | Low | 3.0 | 2023-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). All… |
CVE-2023-24518 | Medium | 6.7 | 2023-10-03 | A Cross-site Request Forgery (CSRF) vulnerability in Pandora FMS allows an attacker to force authenticated users to send a request to a web application they ar… |
CVE-2023-0828 | Medium | 6.7 | 2023-10-03 | Cross-site Scripting (XSS) vulnerability in Syslog Section of Pandora FMS allows attacker to cause that users cookie value will be transferred to the attackers… |
CVE-2023-24517 | Medium | 6.4 | 2023-08-22 | Unrestricted Upload of File with Dangerous Type vulnerability in the Pandora FMS File Manager component, allows an attacker to make make use of this issue ( un… |
CVE-2023-24516 | Medium | 5.9 | 2023-08-22 | Cross-site Scripting (XSS) vulnerability in the Pandora FMS Special Days component allows an attacker to use it to steal the session cookie value of admin use… |
CVE-2023-24515 | Medium | 5.2 | 2023-08-22 | Server-Side Request Forgery (SSRF) vulnerability in API checker of Pandora FMS. Application does not have a check on the URL scheme used while retrieving API U… |
CVE-2023-24514 | Medium | 6.3 | 2023-08-22 | Cross-site Scripting (XSS) vulnerability in Visual Console Module of Pandora FMS could be used to hijack admin users session cookie values, carry out phishing… |
CVE-2023-2807 | Medium | 6.4 | 2023-06-13 | Authentication Bypass by Spoofing vulnerability in the password reset process of Pandora FMS allows an unauthenticated attacker to initiate a password reset pr… |
CVE-2022-47373 | Medium | 6.4 | 2023-02-15 | Reflected Cross Site Scripting in Search Functionality of Module Library in Pandora FMS Console v766 and lower. This vulnerability arises on the forget passwor… |
CVE-2022-47372 | High | 7.6 | 2023-02-15 | Stored cross-site scripting vulnerability in the Create event section in Pandora FMS Console v766 and lower. An attacker typically exploits this vulnerability… |
CVE-2022-45437 | Medium | 6.5 | 2023-02-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Artica PFMS Pandora FMS v765 on all allows Cross-Site Scr… |
CVE-2022-45436 | Medium | 6.1 | 2023-02-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Artica PFMS Pandora FMS v765 on all platforms, allows Cro… |
CVE-2022-43980 | Medium | 5.2 | 2023-01-27 | There is a stored cross-site scripting vulnerability in Pandora FMS v765 in the network maps editing functionality. An attacker could modify a network map, inc… |
CVE-2022-43979 | Medium | 5.9 | 2023-01-27 | There is a Path Traversal that leads to a Local File Inclusion in Pandora FMS v764. A function is called to check that the parameter that the user has inserted… |
CVE-2022-43978 | Medium | 5.6 | 2023-01-27 | There is an improper authentication vulnerability in Pandora FMS v764. The application verifies that the user has a valid session when he is not trying to do a… |
CVE-2021-46680 | Medium | 4.0 | 2022-08-05 | A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via the module form name field. |
CVE-2021-46679 | Medium | 4.0 | 2022-08-05 | A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via service elements. |
CVE-2021-46678 | Medium | 4.0 | 2022-08-05 | A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via the service name field. |
CVE-2021-46677 | Medium | 4.0 | 2022-08-05 | A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via the event filter name field. |
CVE-2021-46676 | Medium | 4.0 | 2022-08-05 | A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via the transactional maps name f… |
CVE-2022-26310 | High | 7.3 | 2022-08-01 | Pandora FMS v7.0NG.760 and below allows an improper authorization in User Management where any authenticated user with access to the User Management module cou… |
CVE-2022-26309 | Low | 3.7 | 2022-08-01 | Pandora FMS v7.0NG.759 allows Cross-Site Request Forgery in Bulk operation (User operation) resulting in elevation of privilege to Administrator group. |
CVE-2022-26308 | Low | 3.7 | 2022-08-01 | Pandora FMS v7.0NG.760 and below allows an improper access control in Configuration (Credential store) where a user with the role of Operator (Write) could cre… |
CVE-2022-1648 | Medium | 5.7 | 2022-07-26 | Pandora FMS v7.0NG.760 and below allows a relative path traversal in File Manager where a privileged user could upload a .php file outside the intended images… |
CVE-2022-2059 | Low | 3.5 | 2022-07-25 | In Pandora FMS v7.0NG.761 and below, in the agent creation section, the alias parameter is vulnerable to a Stored Cross Site-Scripting. This vulnerability can… |
CVE-2022-2032 | Low | 3.5 | 2022-07-25 | In Pandora FMS v7.0NG.761 and below, in the file manager section, the dirname parameter is vulnerable to a Stored Cross Site-Scripting. This vulnerability can… |
CVE-2022-0507 | Medium | 5.8 | 2022-03-10 | Found a potential security vulnerability inside the Pandora API. Affected Pandora FMS version range: all versions of NG version, up to OUM 759. This vulnerabil… |
CVE-2021-35501 | Medium | 5.4 | 2021-06-25 | PandoraFMS <=7.54 allows Stored XSS by placing a payload in the name field of a visual console. When a user or an administrator visits the console, the XSS pay… |
CVE-2021-34074 | Critical | 9.8 | 2021-06-25 | PandoraFMS <=7.54 allows arbitrary file upload, it leading to remote command execution via the File Manager. To bypass the built-in protection, a relative path… |
CVE-2020-11749 | Critical | 9.0 | 2020-07-13 | Pandora FMS 7.0 NG <= 746 suffers from Multiple XSS vulnerabilities in different browser views. A network administrator scanning a SNMP device can trigger a Cr… |
CVE-2020-13855 | High | 7.2 | 2020-06-11 | Artica Pandora FMS 7.44 allows arbitrary file upload (leading to remote command execution) via the File Repository Manager feature. |
CVE-2020-13854 | Critical | 9.8 | 2020-06-11 | Artica Pandora FMS 7.44 allows privilege escalation. |
CVE-2020-13853 | Medium | 5.4 | 2020-06-11 | Artica Pandora FMS 7.44 has persistent XSS in the Messages feature. |
CVE-2020-13852 | High | 7.2 | 2020-06-11 | Artica Pandora FMS 7.44 allows arbitrary file upload (leading to remote command execution) via the File Manager feature. |
CVE-2020-13851 | High | 8.8 | 2020-06-11 | Artica Pandora FMS 7.44 allows remote command execution via the events feature. |
CVE-2020-13850 | High | 7.5 | 2020-06-11 | Artica Pandora FMS 7.44 has inadequate access controls on a web folder. |
CVE-2019-19968 | Medium | 5.4 | 2020-02-04 | PandoraFMS 742 suffers from multiple XSS vulnerabilities, affecting the Agent Management, Report Builder, and Graph Builder components. An authenticated user c… |
CVE-2019-13035 | High | 7.8 | 2019-06-29 | Artica Pandora FMS 7.0 NG before 735 suffers from local privilege escalation due to improper permissions on C:\PandoraFMS and its sub-folders, allowing standar… |
CVE-2018-11223 | Medium | 5.4 | 2018-06-16 | XSS in Artica Pandora FMS before 7.0 NG 723 allows an attacker to execute arbitrary code via a crafted "refr" parameter in a "/pandora_console/index.php?sec=es… |
CVE-2014-8629 | | | 2014-11-19 | Cross-site scripting (XSS) vulnerability in the Page visualization agents in Pandora FMS 5.1 SP1 and earlier allows remote attackers to inject arbitrary web sc… |