Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (16 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2014-125115 3 Artica, Pandora Fms, Pandorafms 3 Pandora Fms, Pandora Fms, Pandora Fms 2026-04-15 N/A
An unauthenticated SQL injection vulnerability exists in Pandora FMS version 5.0 SP2 and earlier. The mobile/index.php endpoint fails to properly sanitize user input in the loginhash_data parameter, allowing attackers to extract administrator credentials or active session tokens via crafted requests. This occurs because input is directly concatenated into an SQL query without adequate validation, enabling SQL injection. After authentication is bypassed, a second vulnerability in the File Manager component permits arbitrary PHP file uploads. The file upload functionality does not enforce MIME-type or file extension restrictions, allowing authenticated users to upload web shells into a publicly accessible directory and achieve remote code execution.
CVE-2014-125124 3 Artica, Pandora Fms, Pandorafms 4 Pandora Fms, Pandora Fms, Artica Pandora Fms and 1 more 2026-04-15 N/A
An unauthenticated remote command execution vulnerability exists in Pandora FMS versions up to and including 5.0RC1 via the Anyterm web interface, which listens on TCP port 8023. The anyterm-module endpoint accepts unsanitized user input via the p parameter and directly injects it into a shell command, allowing arbitrary command execution as the pandora user. In certain versions (notably 4.1 and 5.0RC1), the pandora user can elevate privileges to root without a password using a chain involving the artica user account. This account is typically installed without a password and is configured to run sudo without authentication. Therefore, full system compromise is possible without any credentials.
CVE-2025-34088 3 Artica, Pandora Fms, Pandorafms 3 Pandora Fms, Pandora Fms, Pandora Fms 2026-04-07 8.8 High
An authenticated remote code execution vulnerability exists in Pandora FMS version 7.0NG and earlier. The net_tools.php functionality allows authenticated users to execute arbitrary OS commands via the select_ips parameter when performing network tools operations, such as pinging. This occurs because user input is not properly sanitized before being passed to system commands, enabling command injection.
CVE-2014-8629 1 Pandorafms 1 Pandora Flexible Monitoring System 2025-04-12 N/A
Cross-site scripting (XSS) vulnerability in the Page visualization agents in Pandora FMS 5.1 SP1 and earlier allows remote attackers to inject arbitrary web script or HTML via the refr parameter to index.php.
CVE-2021-35501 1 Pandorafms 1 Pandora Fms 2024-11-21 5.4 Medium
PandoraFMS <=7.54 allows Stored XSS by placing a payload in the name field of a visual console. When a user or an administrator visits the console, the XSS payload will be executed.
CVE-2021-34074 1 Pandorafms 1 Pandora Fms 2024-11-21 9.8 Critical
PandoraFMS <=7.54 allows arbitrary file upload, it leading to remote command execution via the File Manager. To bypass the built-in protection, a relative path is used in the requests.
CVE-2020-13855 1 Pandorafms 1 Pandora Fms 2024-11-21 7.2 High
Artica Pandora FMS 7.44 allows arbitrary file upload (leading to remote command execution) via the File Repository Manager feature.
CVE-2020-13854 1 Pandorafms 1 Pandora Fms 2024-11-21 9.8 Critical
Artica Pandora FMS 7.44 allows privilege escalation.
CVE-2020-13853 1 Pandorafms 1 Pandora Fms 2024-11-21 5.4 Medium
Artica Pandora FMS 7.44 has persistent XSS in the Messages feature.
CVE-2020-13852 1 Pandorafms 1 Pandora Fms 2024-11-21 7.2 High
Artica Pandora FMS 7.44 allows arbitrary file upload (leading to remote command execution) via the File Manager feature.
CVE-2020-13851 1 Pandorafms 1 Pandora Fms 2024-11-21 8.8 High
Artica Pandora FMS 7.44 allows remote command execution via the events feature.
CVE-2020-13850 1 Pandorafms 1 Pandora Fms 2024-11-21 7.5 High
Artica Pandora FMS 7.44 has inadequate access controls on a web folder.
CVE-2020-11749 1 Pandorafms 1 Pandora Fms 2024-11-21 9.0 Critical
Pandora FMS 7.0 NG <= 746 suffers from Multiple XSS vulnerabilities in different browser views. A network administrator scanning a SNMP device can trigger a Cross Site Scripting (XSS), which can run arbitrary code to allow Remote Code Execution as root or apache2.
CVE-2019-19968 1 Pandorafms 1 Pandora Fms 2024-11-21 5.4 Medium
PandoraFMS 742 suffers from multiple XSS vulnerabilities, affecting the Agent Management, Report Builder, and Graph Builder components. An authenticated user can inject dangerous content into a data store that is later read and included in dynamic content.
CVE-2019-13035 1 Pandorafms 1 Pandora Fms 2024-11-21 N/A
Artica Pandora FMS 7.0 NG before 735 suffers from local privilege escalation due to improper permissions on C:\PandoraFMS and its sub-folders, allowing standard users to create new files. Moreover, the Apache service httpd.exe will try to execute cmd.exe from C:\PandoraFMS (the current directory) as NT AUTHORITY\SYSTEM upon web requests to the portal. This will effectively allow non-privileged users to escalate privileges to NT AUTHORITY\SYSTEM.
CVE-2018-11223 1 Pandorafms 1 Artica Pandora Fms 2024-11-21 N/A
XSS in Artica Pandora FMS before 7.0 NG 723 allows an attacker to execute arbitrary code via a crafted "refr" parameter in a "/pandora_console/index.php?sec=estado&sec2=operation/agentes/estado_agente&refr=" call.