Vulnerabilities

TI-2026-26484 CVE-2026-34187 · GHSA-wxjr-vrjv-wjm5

SQL Injection in Graph Container Parameter

LOW 35

Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via graph container parameter.

CVSS 4.0HIGH 7.6 Network Low privileges No interaction EPSS 0.00274 Published 2026-05-12 No fix listed CWE-89

TI-2026-23639 CVE-2026-30810 · GHSA-xvxp-pj7j-gmjj

Server-Side Request Forgery in API Checker leads to Privilege Escalation

LOW 31

Server-Side Request Forgery vulnerability allows Privilege Escalation via API Checker extension.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00302 Published 2026-05-12 No fix listed CWE-918

TI-2026-23637 CVE-2026-30808 · GHSA-j2qp-cx58-m78p

Session Fixation in Authentication leads to Session Hijacking

LOW 35

Session Fixation vulnerability allows Session Hijacking via crafted session ID.

CVSS 4.0HIGH 7.6 Network No auth User interaction EPSS 0.00267 Published 2026-05-12 No fix listed CWE-384

TI-2026-23636 CVE-2026-30807 · GHSA-x5vj-9j33-4gff

Cross-Site Request Forgery on Extension Pages

LOW 32

Cross-Site Request Forgery vulnerability allows an attacker to perform unauthorized actions via crafted web page.

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.00144 Published 2026-05-12 No fix listed CWE-352

TI-2026-23634 CVE-2026-30805 · GHSA-m2m9-vhw3-w774

Insecure Default Initialization in API Authentication leads to Authentication Bypass

MEDIUM 41

Insecure Default Initialization of Resource vulnerability allows Authentication Bypass via API access.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00341 Published 2026-05-12 No fix listed CWE-1188

TI-2026-26485 CVE-2026-34188 · GHSA-xqmq-m74q-gr4q

OS Command Injection in Event Response Execution

LOW 37

Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via Event Response execution.

CVSS 4.0HIGH 7.5 Network High privileges No interaction EPSS 0.01074 Published 2026-04-13 No fix listed CWE-78

TI-2026-26483 CVE-2026-34186 · GHSA-4hgf-5jwc-7v3g

SQL Injection in Custom Fields leads to Database Compromise

LOW 39

Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via custom fields.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00249 Published 2026-04-13 No fix listed CWE-89

TI-2026-23642 CVE-2026-30813 · GHSA-chf8-3p4x-rchj

SQL Injection in Module Search leads to Database Compromise

MEDIUM 40

Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via module search.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00339 Published 2026-04-13 No fix listed CWE-89

TI-2026-23641 CVE-2026-30812 · GHSA-4g9c-4vrc-qw29

Stored Cross-Site Scripting in Event Comments via Filter Bypass

LOW 10

Improper Neutralization of Input During Web Page Generation vulnerability allows Stored Cross-Site Scripting via event comments.

CVSS 4.0LOW 2.1 Network Low privileges User interaction EPSS 0.00179 Published 2026-04-13 No fix listed CWE-79

TI-2026-23640 CVE-2026-30811 · GHSA-m9vq-hc45-mf4h

Missing Authorization in Configuration Ajax Endpoint leads to Information Disclosure

LOW 36

Missing Authorization vulnerability allows Exposure of Sensitive Information via configuration endpoint.

CVSS 4.0HIGH 8.4 Network Low privileges No interaction EPSS 0.00269 Published 2026-04-13 No fix listed CWE-276

TI-2026-23638 CVE-2026-30809 · GHSA-9w52-f5xp-pq4c

OS Command Injection in WebServerModuleDebug via Blacklist Bypass leads to Remote Code Execution

MEDIUM 41

Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via WebServerModuleDebug.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00938 Published 2026-04-13 No fix listed CWE-78

TI-2026-23635 CVE-2026-30806 · GHSA-xqc8-jwv2-x9c2

OS Command Injection in Network Report leads to Remote Code Execution

MEDIUM 41

Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via Network Report.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00938 Published 2026-04-13 No fix listed CWE-78

TI-2026-23633 CVE-2026-30804 · GHSA-qvcf-9h3q-2cwq

Unrestricted File Upload in Extension Uploader leads to Remote Code Execution

MEDIUM 40

Unrestricted Upload of File with Dangerous Type vulnerability allows Remote Code Execution via file upload.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00432 Published 2026-04-13 No fix listed CWE-434

TI-2025-04766 CVE-2025-5306 · GHSA-562g-jj97-qmmg

Command Injection in Netflow path

MEDIUM 57

Improper Neutralization of Special Elements in the Netflow directory field may allow OS command injection.

CVSS 4.0HIGH 7.0 Network High privileges No interaction EPSS 0.35686 Published 2025-06-27 No fix listed CWE-77

TI-2024-12043 CVE-2024-12992 · GHSA-4vj9-2vvg-m523

Remote Code Execution leads to Command Injection

MEDIUM 42

Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection via RCE.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.01205 Published 2025-03-17 No fix listed CWE-77

TI-2024-12022 CVE-2024-12971 · GHSA-q2xw-vm55-8v83

QuickShell Authenticated Command Injection

HIGH 74

Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection.This issue affects Pandora FMS from 700 to 777.6

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.61487 Published 2025-03-17 No fix listed CWE-77

TI-2024-23366 CVE-2024-35307 · GHSA-9hrm-r87r-gq63

Argument Injection Leading to Remote Code Execution in Realtime Graph Extension

MEDIUM 44

Argument Injection Leading to Remote Code Execution in Realtime Graph Extension, allowing unauthenticated attackers to execute arbitrary code on the server.

CVSS 4.0CRITICAL 9.4 Adjacent network No auth No interaction EPSS 0.00913 Published 2024-06-10 Fixed in 777 CWE-88

TI-2024-23365 CVE-2024-35306 · GHSA-8f4h-35jg-wp7g

OS Command injection in Ajax PHP files through HTTP Request

MEDIUM 41

OS Command injection in Ajax PHP files via HTTP Request, allows to execute system commands by exploiting variables.

CVSS 4.0HIGH 8.7 Adjacent network High privileges No interaction EPSS 0.00926 Published 2024-06-10 Fixed in 777 CWE-78

TI-2024-23364 CVE-2024-35305 · GHSA-jh77-xp2v-pxpp

Unauth Time-Based SQL Injection via API

MEDIUM 41

Unauth Time-Based SQL Injection in API allows to exploit HTTP request Authorization header.

CVSS 4.0HIGH 8.9 Adjacent network Low privileges No interaction EPSS 0.00374 Published 2024-06-10 Fixed in 777 CWE-89

TI-2024-23363 CVE-2024-35304 · GHSA-hgc2-p5rv-xww2

OS command injection in Pandora FMS

MEDIUM 44

System command injection through Netflow function due to improper input validation, allowing attackers to execute arbitrary system commands.

CVSS 4.0CRITICAL 9.3 Network Low privileges User interaction EPSS 0.01092 Published 2024-06-10 Fixed in 777 CWE-78

TI-2023-22195 CVE-2023-41793 · GHSA-8wmf-4j4m-q5h7

Path Traversal and Untrusted Upload File

LOW 32

: Path Traversal vulnerability in Pandora FMS on all allows Path Traversal.

CVSS 3.1MEDIUM 6.7 Network Low privileges User interaction EPSS 0.00389 Published 2024-03-19 No fix listed CWE-35

TI-2023-23643 CVE-2023-44092 · GHSA-m59h-jq6c-5ph6

OS command injection in Pandora FMS

MEDIUM 43

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Pandora FMS on all allows OS Command Injection.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00846 Published 2024-03-19 No fix listed CWE-78

TI-2023-23642 CVE-2023-44091 · GHSA-m6h6-pgm9-rw33

Unauth Time-Based SQL Injection

MEDIUM 42

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows SQL Injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00452 Published 2024-03-19 No fix listed CWE-89

TI-2023-23641 CVE-2023-44090 · GHSA-q8mf-j7cw-h829

UnautH SQL Injection

LOW 30

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows CVE-2008-5817.

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.00339 Published 2024-03-19 No fix listed CWE-89

TI-2023-22210 CVE-2023-41812 · GHSA-7gj5-vmcv-4jgh

Uploading executables via the file manager

LOW 39

Unrestricted Upload of File with Dangerous Type vulnerability in Pandora FMS on all allows Accessing Functionality Not Properly Constrained by ACLs.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00573 Published 2023-11-23 No fix listed CWE-434

Vulnerabilities

Filters