Pandora FMS

Records97All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical13CVSS 9.0–10.0

CVSS high48CVSS 7.0–8.9

Exploited now

Pandora FMS records in CISA KEV

No Pandora FMS vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Pandora Fms 46 records HIGH Artica Pandora Fms 1 record LOW Pandora Flexible Monitoring System 1 record LOW

Records

97 records

TI-2020-10837 CVE-2020-13851 · GHSA-rm46-c34m-6jvf

Artica Pandora FMS 7.44 allows remote command execution via the events feature.

HIGH 81

Artica Pandora FMS 7.44 allows remote command execution via the events feature.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.90993 Published 2020-06-11 No fix listed CWE-78

TI-2024-12022 CVE-2024-12971 · GHSA-q2xw-vm55-8v83

QuickShell Authenticated Command Injection

HIGH 74

Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection.This issue affects Pandora FMS from 700 to 777.6

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.61487 Published 2025-03-17 No fix listed CWE-77

TI-2024-10486 CVE-2024-11320

Command Injection leading to RCE via LDAP Misconfiguration

HIGH 73

Arbitrary commands execution on the server by exploiting a command injection vulnerability in the LDAP authentication mechanism.

CVSS 4.0MEDIUM 6.9 Network High privileges User interaction EPSS 0.91202 Published 2024-11-21 No fix listed CWE-77

TI-2023-10138 CVE-2023-24517 · GHSA-gg3j-5crr-vx4f

Remote Code Execution via Unrestricted File Upload

HIGH 67

Unrestricted Upload of File with Dangerous Type vulnerability in the Pandora FMS File Manager component, allows an attacker to make make use of this issue ( unrestricted file upload ) to execute arbitrary system commands…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00967 Published 2023-08-22 No fix listed CWE-434

TI-2023-10136 CVE-2023-24515 · GHSA-gc28-v63c-cq65

Server side request forgery in api checker

MEDIUM 62

Server-Side Request Forgery (SSRF) vulnerability in API checker of Pandora FMS.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00436 Published 2023-08-22 No fix listed CWE-918

TI-2025-04766 CVE-2025-5306 · GHSA-562g-jj97-qmmg

Command Injection in Netflow path

MEDIUM 57

Improper Neutralization of Special Elements in the Netflow directory field may allow OS command injection.

CVSS 4.0HIGH 7.0 Network High privileges No interaction EPSS 0.35686 Published 2025-06-27 No fix listed CWE-77

TI-2025-24252 CVE-2025-34088 · GHSA-rjr7-x9gp-9rwg

Pandora FMS Authenticated Remote Code Execution via Ping Module

MEDIUM 55

An authenticated remote code execution vulnerability exists in Pandora FMS version 7.0NG and earlier.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.07389 Published 2025-07-03 No fix listed CWE-78

TI-2020-09433 CVE-2020-11749 · GHSA-w3g2-8xhr-cpj2

Pandora FMS 7.0 NG <= 746 suffers from Multiple XSS vulnerabilities in different browser…

MEDIUM 55

Pandora FMS 7.0 NG <= 746 suffers from Multiple XSS vulnerabilities in different browser views.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.16226 Published 2020-07-13 No fix listed CWE-79

TI-2020-10841 CVE-2020-13855 · GHSA-cr3j-3j7f-8xvv

Artica Pandora FMS 7.44 allows arbitrary file upload (leading to remote command…

MEDIUM 54

Artica Pandora FMS 7.44 allows arbitrary file upload (leading to remote command execution) via the File Repository Manager feature.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.27629 Published 2020-06-11 No fix listed CWE-434

TI-2020-10838 CVE-2020-13852 · GHSA-86xm-5w5j-f75q

Artica Pandora FMS 7.44 allows arbitrary file upload (leading to remote command execution) via the File Manager feature.

MEDIUM 54

Artica Pandora FMS 7.44 allows arbitrary file upload (leading to remote command execution) via the File Manager feature.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.27629 Published 2020-06-11 No fix listed CWE-434

TI-2021-13261 CVE-2021-34074 · GHSA-7v73-wqmq-pqv5

PandoraFMS <=7.54 allows arbitrary file upload, it leading to remote command execution…

MEDIUM 52

PandoraFMS <=7.54 allows arbitrary file upload, it leading to remote command execution via the File Manager.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.07489 Published 2021-06-25 No fix listed CWE-434

TI-2020-10840 CVE-2020-13854 · GHSA-6r63-6v5q-v839

Artica Pandora FMS 7.44 allows privilege escalation.

MEDIUM 47

Artica Pandora FMS 7.44 allows privilege escalation.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02961 Published 2020-06-11 No fix listed CWE-269

TI-2024-23366 CVE-2024-35307 · GHSA-9hrm-r87r-gq63

Argument Injection Leading to Remote Code Execution in Realtime Graph Extension

MEDIUM 44

Argument Injection Leading to Remote Code Execution in Realtime Graph Extension, allowing unauthenticated attackers to execute arbitrary code on the server.

CVSS 4.0CRITICAL 9.4 Adjacent network No auth No interaction EPSS 0.00913 Published 2024-06-10 Fixed in 777 CWE-88

TI-2024-23363 CVE-2024-35304 · GHSA-hgc2-p5rv-xww2

OS command injection in Pandora FMS

MEDIUM 44

System command injection through Netflow function due to improper input validation, allowing attackers to execute arbitrary system commands.

CVSS 4.0CRITICAL 9.3 Network Low privileges User interaction EPSS 0.01092 Published 2024-06-10 Fixed in 777 CWE-78

TI-2023-02630 CVE-2023-2807 · GHSA-w5wr-pv9p-hfhr

Authentication bypass in password reset process

MEDIUM 44

Authentication Bypass by Spoofing vulnerability in the password reset process of Pandora FMS allows an unauthenticated attacker to initiate a password reset process for any user account without proper authentication.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00618 Published 2023-06-13 No fix listed CWE-290

TI-2022-21614 CVE-2022-43979 · GHSA-4vwg-hrx4-49q3

Path Traversal leading to Local File Inclusion

MEDIUM 44

There is a Path Traversal that leads to a Local File Inclusion in Pandora FMS v764.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00855 Published 2023-01-27 No fix listed CWE-434

TI-2023-23643 CVE-2023-44092 · GHSA-m59h-jq6c-5ph6

OS command injection in Pandora FMS

MEDIUM 43

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Pandora FMS on all allows OS Command Injection.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00846 Published 2024-03-19 No fix listed CWE-78

TI-2023-22206 CVE-2023-41807 · GHSA-5h3j-cm6x-qcr2

Linux Local Privilege Escalation Via GoTTY Page

MEDIUM 43

Improper Privilege Management vulnerability in Pandora FMS on all allows Privilege Escalation.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00734 Published 2023-11-23 No fix listed CWE-269

TI-2023-22192 CVE-2023-41790 · GHSA-83wp-743r-qp4g

Traversal Path on PHP file

MEDIUM 43

Uncontrolled Search Path Element vulnerability in Pandora FMS on all allows Leveraging/Manipulating Configuration File Search Paths.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00573 Published 2023-11-23 No fix listed CWE-427

TI-2023-04310 CVE-2023-4677 · GHSA-668m-jr2r-pqfp

Unauthenticated Admin Account Takeover Via Cron Log File Backups

MEDIUM 43

Cron log backup files contain administrator session IDs.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00493 Published 2023-11-23 No fix listed CWE-287

TI-2024-12043 CVE-2024-12992 · GHSA-4vj9-2vvg-m523

Remote Code Execution leads to Command Injection

MEDIUM 42

Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection via RCE.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.01205 Published 2025-03-17 No fix listed CWE-77

TI-2023-23642 CVE-2023-44091 · GHSA-m6h6-pgm9-rw33

Unauth Time-Based SQL Injection

MEDIUM 42

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows SQL Injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00452 Published 2024-03-19 No fix listed CWE-89

TI-2026-23638 CVE-2026-30809 · GHSA-9w52-f5xp-pq4c

OS Command Injection in WebServerModuleDebug via Blacklist Bypass leads to Remote Code Execution

MEDIUM 41

Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via WebServerModuleDebug.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00938 Published 2026-04-13 No fix listed CWE-78

TI-2026-23635 CVE-2026-30806 · GHSA-xqc8-jwv2-x9c2

OS Command Injection in Network Report leads to Remote Code Execution

MEDIUM 41

Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via Network Report.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00938 Published 2026-04-13 No fix listed CWE-78

TI-2026-23634 CVE-2026-30805 · GHSA-m2m9-vhw3-w774

Insecure Default Initialization in API Authentication leads to Authentication Bypass

MEDIUM 41

Insecure Default Initialization of Resource vulnerability allows Authentication Bypass via API access.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00341 Published 2026-05-12 No fix listed CWE-1188

Open these records in search →