Pandora FMS vulnerabilities
56 CVEs and advisories name Pandora FMS as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-75786SQL Injection in Grafana Integration Endpoint (query.php)
- CVE-2026-64950Stored Cross-Site Scripting via Directory Name in File Manager Create Directory
- CVE-2026-64949Unrestricted File Upload Leading to Remote Code Execution in Admin Tools File Manager
- CVE-2026-64948Missing Authorization in get_module_detail AJAX Endpoint Allows Cross-Group Module Data Disclosure
- CVE-2026-64947CSRF Bypass Leading to Remote Code Execution via Unrestricted File Upload in Plugin File Manager
- CVE-2026-64946CSRF Bypass Leading to Stored Cross-Site Scripting via Unrestricted SVG Upload in File Manager
- CVE-2026-34190CSRF in Alert Command Deletion
- CVE-2026-34189CSRF in Event Response Deletion
- CVE-2026-34187SQL Injection in Graph Container Parameter
- CVE-2026-30810Server-Side Request Forgery in API Checker leads to Privilege Escalation
- CVE-2026-30808Session Fixation in Authentication leads to Session Hijacking
- CVE-2026-30807Cross-Site Request Forgery on Extension Pages
- CVE-2026-30805Insecure Default Initialization in API Authentication leads to Authentication Bypass
- CVE-2026-34188OS Command Injection in Event Response Execution
- CVE-2026-34186SQL Injection in Custom Fields leads to Database Compromise
- CVE-2026-30813SQL Injection in Module Search leads to Database Compromise
- CVE-2026-30812Stored Cross-Site Scripting in Event Comments via Filter Bypass
- CVE-2026-30811Missing Authorization in Configuration Ajax Endpoint leads to Information Disclosure
- CVE-2026-30809OS Command Injection in WebServerModuleDebug via Blacklist Bypass leads to Remote Code Execution
- CVE-2026-30806OS Command Injection in Network Report leads to Remote Code Execution
- CVE-2026-30804Unrestricted File Upload in Extension Uploader leads to Remote Code Execution
- CVE-2025-5306Command Injection in Netflow path
- CVE-2025-4678Remote Code Execution leads to Command Injection
- CVE-2025-4653Remote Code Execution leads to Command Injection
- CVE-2024-12992Remote Code Execution leads to Command Injection
- CVE-2024-12971QuickShell Authenticated Command Injection
- CVE-2024-11320Command Injection leading to RCE via LDAP Misconfiguration
- CVE-2024-35308Post-auth Arbitrary File Read in the Server Plugins Section
- CVE-2024-9987SQL Injection in CSV Module Data Collection
- CVE-2024-35307Argument Injection Leading to Remote Code Execution in Realtime Graph Extension