Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

Pandora FMS — Vulnerabilities & Security Advisories 76

All 76 CVE vulnerabilities found in Pandora FMS, with AI-generated Chinese analysis, references, and POCs.

This page documents Common Weakness Enumeration (CWE) vulnerabilities associated with the Pandora FMS product developed by Softcatala. It aggregates security data related to the network monitoring solution, providing a centralized view of identified weaknesses and their technical classifications. The collection includes a comprehensive range of vulnerability types such as remote code execution, cross-site scripting, and privilege escalation flaws that have been reported against Pandora FMS. The data covers the period from the product's early releases through the most recent updates, ensuring historical context is preserved alongside current threat intelligence. This time range allows for a thorough analysis of how security postures have evolved over the years. Visitors can use this resource to track vendor advisories and monitor the frequency and nature of reported issues for Pandora FMS. The page facilitates a deeper understanding of specific weakness classes by linking common CVEs to their underlying CWE categories, helping security professionals identify patterns in defect types. Additionally, users can look up the product's vulnerability history to assess risk exposure across different versions and deployment scenarios. This structured overview supports informed decision-making for patch management and security hardening efforts. By presenting aggregated data without marketing fluff, the page serves as a factual reference for IT administrators, security analysts, and auditors who need precise information about known flaws in this specific enterprise monitoring software.

Vendor: Artica PFMS

CVE IDTitleCVSSSeverityPublished
CVE-2026-34187 SQL Injection in Graph Container Parameter CWE-89--2026-05-12
CVE-2026-30810 Server-Side Request Forgery in API Checker leads to Privilege Escalation CWE-918--2026-05-12
CVE-2026-30808 Session Fixation in Authentication leads to Session Hijacking CWE-384--2026-05-12
CVE-2026-30807 Cross-Site Request Forgery on Extension Pages CWE-352--2026-05-12
CVE-2026-30805 Insecure Default Initialization in API Authentication leads to Authentication Bypass CWE-1188--2026-05-12
CVE-2026-34188 OS Command Injection in Event Response Execution CWE-78 9.8 -2026-04-13
CVE-2026-34186 SQL Injection in Custom Fields leads to Database Compromise CWE-89 9.8 -2026-04-13
CVE-2026-30813 SQL Injection in Module Search leads to Database Compromise CWE-89 9.8 -2026-04-13
CVE-2026-30812 Stored Cross-Site Scripting in Event Comments via Filter Bypass CWE-79 6.1 -2026-04-13
CVE-2026-30811 Missing Authorization in Configuration Ajax Endpoint leads to Information Disclosure CWE-276 7.5 -2026-04-13
CVE-2026-30809 OS Command Injection in WebServerModuleDebug via Blacklist Bypass leads to Remote Code Execution CWE-78 9.8 -2026-04-13
CVE-2026-30806 OS Command Injection in Network Report leads to Remote Code Execution CWE-78 9.8 -2026-04-13
CVE-2026-30804 Unrestricted File Upload in Extension Uploader leads to Remote Code Execution CWE-434 9.8 -2026-04-13
CVE-2014-125124 Pandora FMS <= 5.0RC1 Anyterm Unauthenticated Command Injection CWE-78 9.8AICriticalAI2025-07-31
CVE-2014-125115 Pandora FMS ≤ 5.0 SP2 Default Credential SQL Injection RCE CWE-798 9.8 -2025-07-25
CVE-2025-34088 Pandora FMS Authenticated Remote Code Execution via Ping Module CWE-78 8.8AIHighAI2025-07-03
CVE-2025-5306 Command Injection in Netflow path CWE-77 9.8AICriticalAI2025-06-27
CVE-2024-12992 Remote Code Execution leads to Command Injection CWE-77 9.8 -2025-03-17
CVE-2024-12971 QuickShell Authenticated Command Injection CWE-77 9.8 -2025-03-17
CVE-2024-11320 Command Injection leading to RCE via LDAP Misconfiguration CWE-77 9.8AICriticalAI2024-11-21
CVE-2024-35308 Post-auth Arbitrary File Read in the Server Plugins Section CWE-22 6.5AIMediumAI2024-10-22
CVE-2024-9987 SQL Injection in CSV Module Data Collection CWE-89 8.8AIHighAI2024-10-22
CVE-2024-35307 Argument Injection Leading to Remote Code Execution in Realtime Graph Extension CWE-88 9.8 -2024-06-10
CVE-2024-35306 OS Command injection in Ajax PHP files through HTTP Request CWE-78 9.8 -2024-06-10
CVE-2024-35305 Unauth Time-Based SQL Injection via API CWE-89 9.8 -2024-06-10
CVE-2024-35304 System command injection through Netflow function CWE-78 9.8 -2024-06-10
CVE-2023-41793 Path Traversal and Untrusted Upload File CWE-35 6.7 Medium2024-03-19
CVE-2023-44092 OS Command Injection CWE-78 7.6 High2024-03-19
CVE-2023-44091 Unauth Time-Based SQL Injection CWE-89 7.5 High2024-03-19
CVE-2023-44090 UnautH SQL Injection CWE-89 6.8 Medium2024-03-19

All 76 known CVE vulnerabilities affecting Pandora FMS with full Chinese analysis, references, and POCs where available.