security@pandorafms.com
organization01
roles
Roles this identity holds.
02
references
Other names and identifiers for this entity.
nvdUS security@pandorafms.com
03
assessed vulnerabilities (66)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-75786US | — | — | ||
Unsanitized concatenation of the module parameter in the Grafana datasource endpoint allows authenticated blind SQL injection. Affects Pandora FMS from 777 onwards. | ||||
| CVE-2026-64950US | — | — | ||
Missing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows stored XSS, executing without user interaction. Affects Pando… | ||||
| CVE-2026-64949US | — | — | ||
Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files. Affects Pandora FMS from 777 onwards. | ||||
| CVE-2026-64948US | — | — | ||
Missing authorization in module data retrieval allows unauthorized cross-group access to module history. Affects Pandora FMS from 777 onwards. | ||||
| CVE-2026-64947US | — | — | ||
A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP code, resulting in Remote Code Ex… | ||||
| CVE-2026-64946US | — | — | ||
A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltration and administrator… | ||||
| CVE-2026-34190US | — | — | ||
Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of alert commands via sequential, unvalidated GET requests when an authenticated administrator visits a… | ||||
| CVE-2026-34189US | — | — | ||
Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of event responses via a forged GET request when an authenticated administrator visits a malicious page… | ||||
| CVE-2026-34187US | critical9.8 | — | ||
Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via graph container parameter. This issue affects Pandora FMS: from 777 throug… | ||||
| CVE-2026-30810US | high8.8 | — | ||
Server-Side Request Forgery vulnerability allows Privilege Escalation via API Checker extension. This issue affects Pandora FMS: from 777 through 800 | ||||
| CVE-2026-30808US | high8.1 | — | ||
Session Fixation vulnerability allows Session Hijacking via crafted session ID. This issue affects Pandora FMS: from 777 through 800 | ||||
| CVE-2026-30807US | high8.8 | — | ||
Cross-Site Request Forgery vulnerability allows an attacker to perform unauthorized actions via crafted web page. This issue affects Pandora FMS: from 777 through 800 | ||||
| CVE-2026-30805US | critical9.1OT elevated | — | ||
Insecure Default Initialization of Resource vulnerability allows Authentication Bypass via API access. This issue affects Pandora FMS: from 777 through 800 | ||||
| CVE-2026-34188US | high7.2 | — | ||
Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via Event Response execution. This issue affects Pandora FMS: from 777 t… | ||||
| CVE-2026-34186US | high8.8 | — | ||
Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via custom fields. This issue affects Pandora FMS: from 777 through 800 | ||||
| CVE-2026-30813US | high8.8 | — | ||
Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via module search. This issue affects Pandora FMS: from 777 through 800 | ||||
| CVE-2026-30812US | medium5.4 | — | ||
Improper Neutralization of Input During Web Page Generation vulnerability allows Stored Cross-Site Scripting via event comments. This issue affects Pandora FMS: from 777 through 80… | ||||
| CVE-2026-30811US | medium6.5OT elevated | — | ||
Missing Authorization vulnerability allows Exposure of Sensitive Information via configuration endpoint. This issue affects Pandora FMS: from 777 through 800 | ||||
| CVE-2026-30809US | high8.8 | — | ||
Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via WebServerModuleDebug. This issue affects Pandora FMS: from 777 throu… | ||||
| CVE-2026-30806US | high8.8 | — | ||
Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via Network Report. This issue affects Pandora FMS: from 777 through 800 | ||||