# cve.now: Pandora FMS

The newest entries naming Pandora FMS as an affected vendor (up to 200), of 56 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-75786](https://cve.now/CVE-2026-75786.md): SQL Injection in Grafana Integration Endpoint (query.php) (CVSS 7.2)
- [CVE-2026-64950](https://cve.now/CVE-2026-64950.md): Stored Cross-Site Scripting via Directory Name in File Manager Create Directory (CVSS 8.4)
- [CVE-2026-64949](https://cve.now/CVE-2026-64949.md): Unrestricted File Upload Leading to Remote Code Execution in Admin Tools File Manager (CVSS 8.6)
- [CVE-2026-64948](https://cve.now/CVE-2026-64948.md): Missing Authorization in get\_module\_detail AJAX Endpoint Allows Cross-Group Module Data Disclosure (CVSS 7.1)
- [CVE-2026-64947](https://cve.now/CVE-2026-64947.md): CSRF Bypass Leading to Remote Code Execution via Unrestricted File Upload in Plugin File Manager (CVSS 7.5)
- [CVE-2026-64946](https://cve.now/CVE-2026-64946.md): CSRF Bypass Leading to Stored Cross-Site Scripting via Unrestricted SVG Upload in File Manager (CVSS 7.4)
- [CVE-2026-34190](https://cve.now/CVE-2026-34190.md): CSRF in Alert Command Deletion (CVSS 5.9)
- [CVE-2026-34189](https://cve.now/CVE-2026-34189.md): CSRF in Event Response Deletion (CVSS 5.9)
- [CVE-2026-34187](https://cve.now/CVE-2026-34187.md): SQL Injection in Graph Container Parameter (CVSS 7.6)
- [CVE-2026-30810](https://cve.now/CVE-2026-30810.md): Server-Side Request Forgery in API Checker leads to Privilege Escalation (CVSS 7.1)
- [CVE-2026-30808](https://cve.now/CVE-2026-30808.md): Session Fixation in Authentication leads to Session Hijacking (CVSS 7.6)
- [CVE-2026-30807](https://cve.now/CVE-2026-30807.md): Cross-Site Request Forgery on Extension Pages (CVSS 7.1)
- [CVE-2026-30805](https://cve.now/CVE-2026-30805.md): Insecure Default Initialization in API Authentication leads to Authentication Bypass (CVSS 9.1)
- [CVE-2026-34188](https://cve.now/CVE-2026-34188.md): OS Command Injection in Event Response Execution (CVSS 7.5)
- [CVE-2026-34186](https://cve.now/CVE-2026-34186.md): SQL Injection in Custom Fields leads to Database Compromise (CVSS 8.7)
- [CVE-2026-30813](https://cve.now/CVE-2026-30813.md): SQL Injection in Module Search leads to Database Compromise (CVSS 8.7)
- [CVE-2026-30812](https://cve.now/CVE-2026-30812.md): Stored Cross-Site Scripting in Event Comments via Filter Bypass (CVSS 2.1)
- [CVE-2026-30811](https://cve.now/CVE-2026-30811.md): Missing Authorization in Configuration Ajax Endpoint leads to Information Disclosure (CVSS 8.4)
- [CVE-2026-30809](https://cve.now/CVE-2026-30809.md): OS Command Injection in WebServerModuleDebug via Blacklist Bypass leads to Remote Code Execution (CVSS 8.7)
- [CVE-2026-30806](https://cve.now/CVE-2026-30806.md): OS Command Injection in Network Report leads to Remote Code Execution (CVSS 8.7)
- [CVE-2026-30804](https://cve.now/CVE-2026-30804.md): Unrestricted File Upload in Extension Uploader leads to Remote Code Execution (CVSS 8.6)
- [CVE-2025-5306](https://cve.now/CVE-2025-5306.md): Command Injection in Netflow path (CVSS 7.0)
- [CVE-2025-4678](https://cve.now/CVE-2025-4678.md): Remote Code Execution leads to Command Injection (CVSS 7.0)
- [CVE-2025-4653](https://cve.now/CVE-2025-4653.md): Remote Code Execution leads to Command Injection (CVSS 7.0)
- [CVE-2024-12992](https://cve.now/CVE-2024-12992.md): Remote Code Execution leads to Command Injection (CVSS 8.6)
- [CVE-2024-12971](https://cve.now/CVE-2024-12971.md): QuickShell Authenticated Command Injection (CVSS 8.6)
- [CVE-2024-11320](https://cve.now/CVE-2024-11320.md): Command Injection leading to RCE via LDAP Misconfiguration (CVSS 6.9)
- [CVE-2024-35308](https://cve.now/CVE-2024-35308.md): Post-auth Arbitrary File Read in the Server Plugins Section (CVSS 8.3)
- [CVE-2024-9987](https://cve.now/CVE-2024-9987.md): SQL Injection in CSV Module Data Collection (CVSS 8.6)
- [CVE-2024-35307](https://cve.now/CVE-2024-35307.md): Argument Injection Leading to Remote Code Execution in Realtime Graph Extension (CVSS 9.4)
- [CVE-2024-35306](https://cve.now/CVE-2024-35306.md): OS Command injection in Ajax PHP files through HTTP Request (CVSS 8.7)
- [CVE-2024-35305](https://cve.now/CVE-2024-35305.md): Unauth Time-Based SQL Injection via API (CVSS 8.9)
- [CVE-2024-35304](https://cve.now/CVE-2024-35304.md): System command injection through Netflow function (CVSS 9.3)
- [CVE-2023-41793](https://cve.now/CVE-2023-41793.md): Path Traversal and Untrusted Upload File (CVSS 6.7)
- [CVE-2023-44092](https://cve.now/CVE-2023-44092.md): OS Command Injection (CVSS 7.6)
- [CVE-2023-44091](https://cve.now/CVE-2023-44091.md): Unauth Time-Based SQL Injection (CVSS 7.5)
- [CVE-2023-44090](https://cve.now/CVE-2023-44090.md): UnautH SQL Injection (CVSS 6.8)
- [CVE-2023-44089](https://cve.now/CVE-2023-44089.md): XSS in Visual Console (CVSS 6.1)
- [CVE-2023-44088](https://cve.now/CVE-2023-44088.md): SQL Injection in Visual Console (CVSS 5.9)
- [CVE-2023-41815](https://cve.now/CVE-2023-41815.md): XSS in File manager (CVSS 7.5)
- [CVE-2023-41814](https://cve.now/CVE-2023-41814.md): XSS Vulnerability Messages (CVSS 3.7)
- [CVE-2023-41813](https://cve.now/CVE-2023-41813.md): User notification settings edition (CVSS 3.0)
- [CVE-2023-41812](https://cve.now/CVE-2023-41812.md): Uploading executables via the file manager (CVSS 5.7)
- [CVE-2023-41811](https://cve.now/CVE-2023-41811.md): Stored XSS Via Site News Page (CVSS 5.3)
- [CVE-2023-41810](https://cve.now/CVE-2023-41810.md): Stored XSS Via Dashboard Panel (CVSS 4.0)
- [CVE-2023-41808](https://cve.now/CVE-2023-41808.md): Arbitrary File Read As Root Via GoTTY Page (CVSS 8.5)
- [CVE-2023-41807](https://cve.now/CVE-2023-41807.md): Linux Local Privilege Escalation Via GoTTY Page (CVSS 9.1)
- [CVE-2023-41806](https://cve.now/CVE-2023-41806.md): Misassignment of privileges can cause DOS attack (CVSS 8.2)
- [CVE-2023-41792](https://cve.now/CVE-2023-41792.md): Lack of Authorization and Stored XSS Via SNMP Trap Editor Page (CVSS 5.9)
- [CVE-2023-41791](https://cve.now/CVE-2023-41791.md): Lack of Authorization and Stored XSS Via Translation Abuse (CVSS 8.4)
- [CVE-2023-41790](https://cve.now/CVE-2023-41790.md): Traversal Path on PHP file (CVSS 7.6)
- [CVE-2023-41789](https://cve.now/CVE-2023-41789.md): Unauthenticated Admin Account Takeover Via XSS (CVSS 7.6)
- [CVE-2023-41788](https://cve.now/CVE-2023-41788.md): Remote Code Execution via File Uploader (CVSS 7.6)
- [CVE-2023-41787](https://cve.now/CVE-2023-41787.md): Arbitrary File Read (CVSS 6.0)
- [CVE-2023-41786](https://cve.now/CVE-2023-41786.md): Database backups availability by low-privileged users (CVSS 6.8)
- [CVE-2023-4677](https://cve.now/CVE-2023-4677.md): Unauthenticated Admin Account Takeover Via Cron Log File Backups (CVSS 7.0)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/pandora-fms
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.