CVE Database and Vulnerability Search

Browse vendorsBrowse ecosystems

Search CVE and GHSA vulnerability records by identifier, title, vendor, product, package, or CWE. Filter by severity, CISA KEV, ransomware association, linked artifacts, and Nuclei templates; sort by publication date, CVSS, or EPSS.

Vulnerabilities
381,276
with PoCs
37,250
CISA KEV
1,665
Ransomware
606
with Nuclei
4,342
Advanced

Showing 25 vulnerabilities on this page

Signals CISA KEV Ransomware Nuclei
VulnerabilityTitle and contextCVSSEPSSPoCsSignals

SQL Injection in Graph Container Parameter

Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via graph container parameter. This issue affects Pandora FMS: from 777 through 800

CWE-89May 12, 2026
CVSS7.6v4.0EPSS0.274%PoCs0SignalsSTIX

Server-Side Request Forgery in API Checker leads to Privilege Escalation

Server-Side Request Forgery vulnerability allows Privilege Escalation via API Checker extension. This issue affects Pandora FMS: from 777 through 800

CWE-918May 12, 2026
CVSS7.1v4.0EPSS0.302%PoCs0SignalsSTIX

Session Fixation in Authentication leads to Session Hijacking

Session Fixation vulnerability allows Session Hijacking via crafted session ID. This issue affects Pandora FMS: from 777 through 800

CWE-384May 12, 2026
CVSS7.6v4.0EPSS0.267%PoCs0SignalsSTIX

Cross-Site Request Forgery on Extension Pages

Cross-Site Request Forgery vulnerability allows an attacker to perform unauthorized actions via crafted web page. This issue affects Pandora FMS: from 777 through 800

CWE-352May 12, 2026
CVSS7.1v4.0EPSS0.144%PoCs0SignalsSTIX

Insecure Default Initialization in API Authentication leads to Authentication Bypass

Insecure Default Initialization of Resource vulnerability allows Authentication Bypass via API access. This issue affects Pandora FMS: from 777 through 800

CWE-1188May 12, 2026
CVSS9.1v4.0EPSS0.341%PoCs0SignalsSTIX

OS Command Injection in Event Response Execution

Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via Event Response execution. This issue affects Pandora FMS: from 777 through 800

CWE-78Apr 13, 2026
CVSS7.5v4.0EPSS1.07%PoCs0SignalsSTIX

SQL Injection in Custom Fields leads to Database Compromise

Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via custom fields. This issue affects Pandora FMS: from 777 through 800

CWE-89Apr 13, 2026
CVSS8.7v4.0EPSS0.249%PoCs0SignalsSTIX

SQL Injection in Module Search leads to Database Compromise

Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via module search. This issue affects Pandora FMS: from 777 through 800

CWE-89Apr 13, 2026
CVSS8.7v4.0EPSS0.339%PoCs0SignalsSTIX

Stored Cross-Site Scripting in Event Comments via Filter Bypass

Improper Neutralization of Input During Web Page Generation vulnerability allows Stored Cross-Site Scripting via event comments. This issue affects Pandora FMS: from 777 through 800

CWE-79Apr 13, 2026
CVSS2.1v4.0EPSS0.179%PoCs0SignalsSTIX

Missing Authorization in Configuration Ajax Endpoint leads to Information Disclosure

Missing Authorization vulnerability allows Exposure of Sensitive Information via configuration endpoint. This issue affects Pandora FMS: from 777 through 800

CWE-276Apr 13, 2026
CVSS8.4v4.0EPSS0.269%PoCs0SignalsSTIX

OS Command Injection in WebServerModuleDebug via Blacklist Bypass leads to Remote Code Execution

Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via WebServerModuleDebug. This issue affects Pandora FMS: from 777 through 800

CWE-78Apr 13, 2026
CVSS8.7v4.0EPSS0.938%PoCs0SignalsSTIX

OS Command Injection in Network Report leads to Remote Code Execution

Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via Network Report. This issue affects Pandora FMS: from 777 through 800

CWE-78Apr 13, 2026
CVSS8.7v4.0EPSS0.938%PoCs0SignalsSTIX

Unrestricted File Upload in Extension Uploader leads to Remote Code Execution

Unrestricted Upload of File with Dangerous Type vulnerability allows Remote Code Execution via file upload. This issue affects Pandora FMS: from 777 through 800

CWE-434Apr 13, 2026
CVSS8.6v4.0EPSS0.432%PoCs0SignalsSTIX

Command Injection in Netflow path

Improper Neutralization of Special Elements in the Netflow directory field may allow OS command injection. This issue affects Pandora FMS 774 through 778

CWE-77Jun 27, 2025
CVSS7.0v4.0EPSS22.8%PoCs1SignalsSTIX

Remote Code Execution leads to Command Injection

Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection via RCE. This issue affects Pandora FMS from 700 to 777.6 .

CWE-77Mar 17, 2025
CVSS8.6v4.0EPSS1.18%PoCs0SignalsSTIX

QuickShell Authenticated Command Injection

Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection.This issue affects Pandora FMS from 700 to 777.6

CWE-77Mar 17, 2025
CVSS8.6v4.0EPSS58.2%PoCs1SignalsSTIX

Command Injection leading to RCE via LDAP Misconfiguration

Arbitrary commands execution on the server by exploiting a command injection vulnerability in the LDAP authentication mechanism. This issue affects Pandora FMS: from 700 through <=777.4

CWE-77Nov 21, 20241 related artifact
CVSS6.9v4.0EPSS91.1%PoCs2SignalsSTIX

Post-auth Arbitrary File Read in the Server Plugins Section

A post-authentication arbitrary file read vulnerability within the server plugins section in plugin edition feature. This issue affects Pandora FMS: from 700 through <777.3.

CWE-22Oct 22, 2024
CVSS8.3v4.0EPSS0.605%PoCs0SignalsSTIX

SQL Injection in CSV Module Data Collection

A post-authentication SQL Injection vulnerability within the filters parameter of the extensions/agents_modules_csv functionality. This issue affects Pandora FMS: from 700 through <777.3.

CWE-89Oct 22, 2024
CVSS8.6v4.0EPSS0.419%PoCs0SignalsSTIX

Argument Injection Leading to Remote Code Execution in Realtime Graph Extension

Argument Injection Leading to Remote Code Execution in Realtime Graph Extension, allowing unauthenticated attackers to execute arbitrary code on the server. This issue affects Pandora FMS: from 700 through <777.

CWE-88Jun 10, 2024
CVSS9.4v4.0EPSS0.913%PoCs0SignalsSTIX

OS Command injection in Ajax PHP files through HTTP Request

OS Command injection in Ajax PHP files via HTTP Request, allows to execute system commands by exploiting variables. This issue affects Pandora FMS: from 700 through <777.

CWE-78Jun 10, 2024
CVSS8.7v4.0EPSS0.926%PoCs0SignalsSTIX

Unauth Time-Based SQL Injection via API

Unauth Time-Based SQL Injection in API allows to exploit HTTP request Authorization header. This issue affects Pandora FMS: from 700 through <777.

CWE-89Jun 10, 2024
CVSS8.9v4.0EPSS0.374%PoCs0SignalsSTIX

System command injection through Netflow function

System command injection through Netflow function due to improper input validation, allowing attackers to execute arbitrary system commands. This issue affects Pandora FMS: from 700 through <777.

CWE-78Jun 10, 2024
CVSS9.3v4.0EPSS1.09%PoCs0SignalsSTIX

Path Traversal and Untrusted Upload File

: Path Traversal vulnerability in Pandora FMS on all allows Path Traversal. This vulnerability allowed changing directories and creating files and downloading them outside the allowed directories. This issue affects Pandora FMS: from 700 through <776.

CWE-35Mar 19, 2024
CVSS6.7v3.1EPSS0.389%PoCs0SignalsSTIX

OS Command Injection

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Pandora FMS on all allows OS Command Injection. This vulnerability allowed to create a reverse shell and execute commands in the OS. This issue affects Pandora FMS: from 700 through <776.

CWE-78Mar 19, 2024
CVSS7.6v3.1EPSS0.846%PoCs0SignalsSTIX