Pandorafms
Pandorafms Pandora FMS: vulnerabilidades y CVE
Pandorafms Pandora FMS tiene 56 vulnerabilidades publicadas, 8 de ellas en los últimos 12 meses. 7 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE56
Últimos 12 meses8
Críticas7
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-75786 | Alta (7.2) | 0.20% | — | 1 oct 2026 | Unsanitized concatenation of the module parameter in the Grafana datasource endpoint allows authenticated blind SQL injection. Affects Pandora FMS from 777 onwards. |
| CVE-2026-64950 | Alta (8.4) | 0.25% | — | 1 oct 2026 | Missing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows stored XSS, executing without user interaction. Affects Pandora FMS from 777 onwards. |
| CVE-2026-64949 | Alta (8.6) | 0.30% | — | 1 oct 2026 | Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files. Affects Pandora FMS from 777 onwards. |
| CVE-2026-64948 | Alta (7.1) | 0.21% | — | 1 oct 2026 | Missing authorization in module data retrieval allows unauthorized cross-group access to module history. Affects Pandora FMS from 777 onwards. |
| CVE-2026-64947 | Alta (7.5) | 0.25% | — | 1 oct 2026 | A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP code, resulting in Remote Code Execution. This issue affects Pandora… |
| CVE-2026-64946 | Alta (7.4) | 0.16% | — | 1 oct 2026 | A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltration and administrator account takeover. This issue affects… |
| CVE-2026-34190 | Media (5.9) | 0.15% | — | 1 oct 2026 | Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of alert commands via sequential, unvalidated GET requests when an authenticated administrator visits a malicious page. This issue affects… |
| CVE-2026-34189 | Media (5.9) | 0.21% | — | 1 oct 2026 | Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of event responses via a forged GET request when an authenticated administrator visits a malicious page. This issue affects Pandora FMS: from… |
| CVE-2014-125124 | Crítica (10) | 2.1% | — | 31 jul 2025 | An unauthenticated remote command execution vulnerability exists in Pandora FMS versions up to and including 5.0RC1 via the Anyterm web interface, which listens on TCP port 8023. The anyterm-module endpoint accepts… |
| CVE-2014-125115 | Crítica (10) | 2.4% | — | 25 jul 2025 | An unauthenticated SQL injection vulnerability exists in Pandora FMS version 5.0 SP2 and earlier. The mobile/index.php endpoint fails to properly sanitize user input in the loginhash_data parameter, allowing attackers… |
| CVE-2025-34088 | Alta (8.6) | 7.2% | — | 3 jul 2025 | An authenticated remote code execution vulnerability exists in Pandora FMS version 7.0NG and earlier. The net_tools.php functionality allows authenticated users to execute arbitrary OS commands via the select_ips… |
| CVE-2024-11320 | Media (6.9) | 91% | — | 21 nov 2024 | Arbitrary commands execution on the server by exploiting a command injection vulnerability in the LDAP authentication mechanism. This issue affects Pandora FMS: from 700 through <=777.4 |
| CVE-2024-9987 | Alta (8.6) | 0.42% | — | 22 oct 2024 | A post-authentication SQL Injection vulnerability within the filters parameter of the extensions/agents_modules_csv functionality. This issue affects Pandora FMS: from 700 through <777.3. |
| CVE-2024-35308 | Alta (8.3) | 0.61% | — | 22 oct 2024 | A post-authentication arbitrary file read vulnerability within the server plugins section in plugin edition feature. This issue affects Pandora FMS: from 700 through <777.3. |
| CVE-2023-44089 | Media (6.1) | 0.25% | — | 29 dic 2023 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). It was possible to execute malicious JS code on Visual… |
| CVE-2023-44088 | Alta (8.8) | 0.73% | — | 29 dic 2023 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows SQL Injection. Arbitrary SQL queries were allowed to be executed using any account with low… |
| CVE-2023-41815 | Media (6.1) | 0.28% | — | 29 dic 2023 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Malicious code could be executed in the File Manager section.… |
| CVE-2023-41814 | Media (6.1) | 0.26% | — | 29 dic 2023 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Through an HTML payload (iframe tag) it is possible to carry… |
| CVE-2023-41813 | Media (6.1) | 0.29% | — | 29 dic 2023 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Allows you to edit the Web Console user notification options.… |
| CVE-2023-24518 | Alta (7.1) | 0.21% | — | 3 oct 2023 | A Cross-site Request Forgery (CSRF) vulnerability in Pandora FMS allows an attacker to force authenticated users to send a request to a web application they are currently authenticated against. This issue affects… |
| CVE-2023-0828 | Media (6.1) | 0.34% | — | 3 oct 2023 | Cross-site Scripting (XSS) vulnerability in Syslog Section of Pandora FMS allows attacker to cause that users cookie value will be transferred to the attackers users server. This issue affects Pandora FMS v767 version… |
| CVE-2023-24517 | Alta (7.2) | 0.97% | — | 22 ago 2023 | Unrestricted Upload of File with Dangerous Type vulnerability in the Pandora FMS File Manager component, allows an attacker to make make use of this issue ( unrestricted file upload ) to execute arbitrary system… |
| CVE-2023-24516 | Media (5.4) | 0.45% | — | 22 ago 2023 | Cross-site Scripting (XSS) vulnerability in the Pandora FMS Special Days component allows an attacker to use it to steal the session cookie value of admin users easily with little user interaction. This issue affects… |
| CVE-2023-24515 | Media (6.5) | 0.44% | — | 22 ago 2023 | Server-Side Request Forgery (SSRF) vulnerability in API checker of Pandora FMS. Application does not have a check on the URL scheme used while retrieving API URL. Rather than validating the http/https scheme, the… |
| CVE-2023-24514 | Media (6.1) | 0.40% | — | 22 ago 2023 | Cross-site Scripting (XSS) vulnerability in Visual Console Module of Pandora FMS could be used to hijack admin users session cookie values, carry out phishing attacks, etc. This issue affects Pandora FMS v767 version… |
| CVE-2023-2807 | Crítica (9.8) | 0.62% | — | 13 jun 2023 | Authentication Bypass by Spoofing vulnerability in the password reset process of Pandora FMS allows an unauthenticated attacker to initiate a password reset process for any user account without proper authentication.… |
| CVE-2022-47373 | Media (6.1) | 0.34% | — | 15 feb 2023 | Reflected Cross Site Scripting in Search Functionality of Module Library in Pandora FMS Console v766 and lower. This vulnerability arises on the forget password functionality in which parameter username does not proper… |
| CVE-2022-47372 | Media (5.4) | 0.23% | — | 15 feb 2023 | Stored cross-site scripting vulnerability in the Create event section in Pandora FMS Console v766 and lower. An attacker typically exploits this vulnerability by injecting XSS payloads on popular pages of a site or… |
| CVE-2022-45437 | Media (4.8) | 0.43% | — | 15 feb 2023 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Artica PFMS Pandora FMS v765 on all allows Cross-Site Scripting (XSS). A user with edition privileges can create a… |
| CVE-2022-45436 | Media (4.8) | 0.61% | — | 15 feb 2023 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Artica PFMS Pandora FMS v765 on all platforms, allows Cross-Site Scripting (XSS). As a manager privilege user ,… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.