Pandorafms Pandora_fms
46 CVEs affecting Pandorafms Pandora_fms. Latest disclosed: 2025-07-03. Critical: 4, High: 11.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-11320 | Critical | 9.8 | 2024-11-21 | Arbitrary commands execution on the server by exploiting a command injection vulnerability in the LDAP authentication mechanism. This issue affects Pandora FMS… |
CVE-2021-34074 | Critical | 9.8 | 2021-06-25 | PandoraFMS <=7.54 allows arbitrary file upload, it leading to remote command execution via the File Manager. To bypass the built-in protection, a relative path… |
CVE-2020-13854 | Critical | 9.8 | 2020-06-11 | Artica Pandora FMS 7.44 allows privilege escalation. |
CVE-2020-11749 | Critical | 9.0 | 2020-07-13 | Pandora FMS 7.0 NG <= 746 suffers from Multiple XSS vulnerabilities in different browser views. A network administrator scanning a SNMP device can trigger a Cr… |
CVE-2025-34088 | High | 8.8 | 2025-07-03 | An authenticated remote code execution vulnerability exists in Pandora FMS version 7.0NG and earlier. The net_tools.php functionality allows authenticated user… |
CVE-2024-9987 | High | 8.8 | 2024-10-22 | A post-authentication SQL Injection vulnerability within the filters parameter of the extensions/agents_modules_csv functionality. This issue affects Pandora F… |
CVE-2024-35308 | High | 8.8 | 2024-10-22 | A post-authentication arbitrary file read vulnerability within the server plugins section in plugin edition feature. This issue affects Pandora FMS: from 700 t… |
CVE-2020-13851 | High | 8.8 | 2020-06-11 | Artica Pandora FMS 7.44 allows remote command execution via the events feature. |
CVE-2019-13035 | High | 7.8 | 2019-06-29 | Artica Pandora FMS 7.0 NG before 735 suffers from local privilege escalation due to improper permissions on C:\PandoraFMS and its sub-folders, allowing standar… |
CVE-2022-47372 | High | 7.6 | 2023-02-15 | Stored cross-site scripting vulnerability in the Create event section in Pandora FMS Console v766 and lower. An attacker typically exploits this vulnerability… |
CVE-2023-41815 | High | 7.5 | 2023-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Mal… |
CVE-2020-13850 | High | 7.5 | 2020-06-11 | Artica Pandora FMS 7.44 has inadequate access controls on a web folder. |
CVE-2022-26310 | High | 7.3 | 2022-08-01 | Pandora FMS v7.0NG.760 and below allows an improper authorization in User Management where any authenticated user with access to the User Management module cou… |
CVE-2020-13855 | High | 7.2 | 2020-06-11 | Artica Pandora FMS 7.44 allows arbitrary file upload (leading to remote command execution) via the File Repository Manager feature. |
CVE-2020-13852 | High | 7.2 | 2020-06-11 | Artica Pandora FMS 7.44 allows arbitrary file upload (leading to remote command execution) via the File Manager feature. |
CVE-2023-24518 | Medium | 6.7 | 2023-10-03 | A Cross-site Request Forgery (CSRF) vulnerability in Pandora FMS allows an attacker to force authenticated users to send a request to a web application they ar… |
CVE-2023-0828 | Medium | 6.7 | 2023-10-03 | Cross-site Scripting (XSS) vulnerability in Syslog Section of Pandora FMS allows attacker to cause that users cookie value will be transferred to the attackers… |
CVE-2022-45437 | Medium | 6.5 | 2023-02-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Artica PFMS Pandora FMS v765 on all allows Cross-Site Scr… |
CVE-2023-24517 | Medium | 6.4 | 2023-08-22 | Unrestricted Upload of File with Dangerous Type vulnerability in the Pandora FMS File Manager component, allows an attacker to make make use of this issue ( un… |
CVE-2023-2807 | Medium | 6.4 | 2023-06-13 | Authentication Bypass by Spoofing vulnerability in the password reset process of Pandora FMS allows an unauthenticated attacker to initiate a password reset pr… |