Pandora FMS vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-75786 Unsanitized concatenation of the module parameter in the Grafana datasource endpoint allows authenticated blind SQL injection.High 7.2 · Oct 1, 2026
• CVE-2026-64950 Missing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows stored XSS, executing without user interaHigh 8.4 · Oct 1, 2026
• CVE-2026-64949 Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files.High 8.6 · Oct 1, 2026
• CVE-2026-64948 Missing authorization in module data retrieval allows unauthorized cross-group access to module history.High 7.1 · Oct 1, 2026
• CVE-2026-64947 A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP code, resultiHigh 7.5 · Oct 1, 2026
• CVE-2026-64946 A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltratioHigh 7.4 · Oct 1, 2026
• CVE-2026-34187 Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via graph container parameter.High 7.6 · May 12, 2026
• CVE-2026-30810 Server-Side Request Forgery vulnerability allows Privilege Escalation via API Checker extension.High 7.1 · May 12, 2026
• CVE-2026-30808 Session Fixation vulnerability allows Session Hijacking via crafted session ID.High 7.6 · May 12, 2026
• CVE-2026-30807 Cross-Site Request Forgery vulnerability allows an attacker to perform unauthorized actions via crafted web page.High 7.1 · May 12, 2026
• CVE-2026-30805 Insecure Default Initialization of Resource vulnerability allows Authentication Bypass via API access.Critical 9.1 · May 12, 2026
• CVE-2026-34188 Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via Event Response execution.High 7.5 · Apr 13, 2026
• CVE-2026-34186 Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via custom fields.High 8.7 · Apr 13, 2026
• CVE-2026-30813 Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via module search.High 8.7 · Apr 13, 2026
• CVE-2026-30811 Missing Authorization vulnerability allows Exposure of Sensitive Information via configuration endpoint.High 8.4 · Apr 13, 2026
• CVE-2026-30809 Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via WebServerModuleDebug.High 8.7 · Apr 13, 2026
• CVE-2026-30806 Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via Network Report.High 8.7 · Apr 13, 2026
• CVE-2026-30804 Unrestricted Upload of File with Dangerous Type vulnerability allows Remote Code Execution via file upload.High 8.6 · Apr 13, 2026
• CVE-2025-5306 Improper Neutralization of Special Elements in the Netflow directory field may allow OS command injection.High 7 · Jun 27, 2025
• CVE-2025-4678 Improper Neutralization of Special Elements in the chromium_path variable may allow OS command injection.High 7 · Jun 10, 2025
• CVE-2025-4653 Improper Neutralization of Special Elements in the backup name field may allow OS command injection.High 7 · Jun 10, 2025
• CVE-2024-12992 Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection via RCE.High 8.6 · Mar 17, 2025
• CVE-2024-12971 Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection.This issue affects Pandora FMS from 700 to 777.6High 8.6 · Mar 17, 2025
• CVE-2024-9987 A post-authentication SQL Injection vulnerability within the filters parameter of the extensions/agents_modules_csv functionality.High 8.6 · Oct 22, 2024
• CVE-2024-35308 A post-authentication arbitrary file read vulnerability within the server plugins section in plugin edition feature.High 8.3 · Oct 22, 2024