Pandorafms Pandora Fms vulnerabilities

CVE-2020-13851 [HIGH] CWE-78 CVE-2020-13851: Artica Pandora FMS 7.44 allows remote command execution via the events feature. Artica Pandora FMS 7.44 allows remote command execution via the events feature.

CVE-2024-11320 [CRITICAL] CWE-77 CVE-2024-11320: Arbitrary commands execution on the server by exploiting a command injection vulnerability in the LD Arbitrary commands execution on the server by exploiting a command injection vulnerability in the LDAP authentication mechanism. This issue affects Pandora FMS: from 700 through <=777.4

CVE-2025-34088 [HIGH] CWE-78 CVE-2025-34088: An authenticated remote code execution vulnerability exists in Pandora FMS version 7.0NG and earlier An authenticated remote code execution vulnerability exists in Pandora FMS version 7.0NG and earlier. The net_tools.php functionality allows authenticated users to execute arbitrary OS commands via the select_ips parameter when performing network tools operations, such as pinging. This occurs because user input is not properly sanitized before being pa

CVE-2023-44088 [HIGH] CWE-89 CVE-2023-44088: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows SQL Injection. Arbitrary SQL queries were allowed to be executed using any account with low privileges. This issue affects Pandora FMS: from 700 through 774.

CVE-2020-11749 [CRITICAL] CWE-79 CVE-2020-11749: Pandora FMS 7.0 NG <= 746 suffers from Multiple XSS vulnerabilities in different browser views. A ne Pandora FMS 7.0 NG <= 746 suffers from Multiple XSS vulnerabilities in different browser views. A network administrator scanning a SNMP device can trigger a Cross Site Scripting (XSS), which can run arbitrary code to allow Remote Code Execution as root or apache2.

CVE-2021-34074 [CRITICAL] CWE-434 CVE-2021-34074: PandoraFMS <=7.54 allows arbitrary file upload, it leading to remote command execution via the File PandoraFMS <=7.54 allows arbitrary file upload, it leading to remote command execution via the File Manager. To bypass the built-in protection, a relative path is used in the requests.

CVE-2023-2807 [CRITICAL] CWE-290 CVE-2023-2807: Authentication Bypass by Spoofing vulnerability in the password reset process of Pandora FMS allows Authentication Bypass by Spoofing vulnerability in the password reset process of Pandora FMS allows an unauthenticated attacker to initiate a password reset process for any user account without proper authentication. This issue affects PandoraFMS v771 and prior versions on all platforms.

CVE-2020-13852 [HIGH] CWE-434 CVE-2020-13852: Artica Pandora FMS 7.44 allows arbitrary file upload (leading to remote command execution) via the F Artica Pandora FMS 7.44 allows arbitrary file upload (leading to remote command execution) via the File Manager feature.

CVE-2020-13855 [HIGH] CWE-434 CVE-2020-13855: Artica Pandora FMS 7.44 allows arbitrary file upload (leading to remote command execution) via the F Artica Pandora FMS 7.44 allows arbitrary file upload (leading to remote command execution) via the File Repository Manager feature.

CVE-2024-35308 [HIGH] CWE-22 CVE-2024-35308: A post-authentication arbitrary file read vulnerability within the server plugins section in plugin A post-authentication arbitrary file read vulnerability within the server plugins section in plugin edition feature. This issue affects Pandora FMS: from 700 through <777.3.

CVE-2024-9987 [HIGH] CWE-89 CVE-2024-9987: A post-authentication SQL Injection vulnerability within the filters parameter of the extensions/age A post-authentication SQL Injection vulnerability within the filters parameter of the extensions/agents_modules_csv functionality. This issue affects Pandora FMS: from 700 through <777.3.

CVE-2022-0507 [HIGH] CWE-89 CVE-2022-0507: Found a potential security vulnerability inside the Pandora API. Affected Pandora FMS version range: Found a potential security vulnerability inside the Pandora API. Affected Pandora FMS version range: all versions of NG version, up to OUM 759. This vulnerability could allow an attacker with authenticated IP to inject SQL.

CVE-2022-26310 [HIGH] CWE-285 CVE-2022-26310: Pandora FMS v7.0NG.760 and below allows an improper authorization in User Management where any authe Pandora FMS v7.0NG.760 and below allows an improper authorization in User Management where any authenticated user with access to the User Management module could create, modify or delete any user with full admin privilege. The impact could lead to a vertical privilege escalation to access the privileges of a higher-level user or typically an admin use

CVE-2022-43979 [CRITICAL] CWE-434 CVE-2022-43979: There is a Path Traversal that leads to a Local File Inclusion in Pandora FMS v764. A function is ca There is a Path Traversal that leads to a Local File Inclusion in Pandora FMS v764. A function is called to check that the parameter that the user has inserted does not contain malicious characteres, but this check is insufficient. An attacker could insert an absolute path to overcome the heck, thus being able to incluse any PHP file that resides

CVE-2020-13854 [CRITICAL] CWE-269 CVE-2020-13854: Artica Pandora FMS 7.44 allows privilege escalation. Artica Pandora FMS 7.44 allows privilege escalation.

CVE-2023-24517 [HIGH] CWE-434 CVE-2023-24517: Unrestricted Upload of File with Dangerous Type vulnerability in the Pandora FMS File Manager compon Unrestricted Upload of File with Dangerous Type vulnerability in the Pandora FMS File Manager component, allows an attacker to make make use of this issue ( unrestricted file upload ) to execute arbitrary system commands. This issue affects Pandora FMS v767 version and prior versions on all platforms.

CVE-2022-1648 [HIGH] CWE-23 CVE-2022-1648: Pandora FMS v7.0NG.760 and below allows a relative path traversal in File Manager where a privileged Pandora FMS v7.0NG.760 and below allows a relative path traversal in File Manager where a privileged user could upload a .php file outside the intended images directory which is restricted to execute the .php file. The impact could lead to a Remote Code Execution with running application privilege.

CVE-2020-13850 [HIGH] CWE-425 CVE-2020-13850: Artica Pandora FMS 7.44 has inadequate access controls on a web folder. Artica Pandora FMS 7.44 has inadequate access controls on a web folder.

CVE-2019-13035 [HIGH] CVE-2019-13035: Artica Pandora FMS 7.0 NG before 735 suffers from local privilege escalation due to improper permiss Artica Pandora FMS 7.0 NG before 735 suffers from local privilege escalation due to improper permissions on C:\PandoraFMS and its sub-folders, allowing standard users to create new files. Moreover, the Apache service httpd.exe will try to execute cmd.exe from C:\PandoraFMS (the current directory) as NT AUTHORITY\SYSTEM upon web requests to the portal. This wi

CVE-2022-26309 [HIGH] CWE-352 CVE-2022-26309: Pandora FMS v7.0NG.759 allows Cross-Site Request Forgery in Bulk operation (User operation) resultin Pandora FMS v7.0NG.759 allows Cross-Site Request Forgery in Bulk operation (User operation) resulting in elevation of privilege to Administrator group.