CVE-2025-4653

🗓️ 10 Jun 2025 15:53:22Reported by PandoraFMSType

cve🔗 web.nvd.nist.gov👁 81 Views🌐 WEB

Remote Code Execution in Pandora ITSM 5.0.105 allows command injection via backup name field.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2025-4653	10 Jun 202517:41	–	circl
CNNVD	PandoraFMS ITSM 安全漏洞	10 Jun 202500:00	–	cnnvd
Cvelist	CVE-2025-4653 Remote Code Execution leads to Command Injection	10 Jun 202515:53	–	cvelist
EUVD	EUVD-2025-17710	10 Jun 202518:32	–	euvd
Metasploit	Pandora ITSM authenticated command injection leading to RCE via the backup function	7 Aug 202518:52	–	metasploit
NVD	CVE-2025-4653	10 Jun 202516:15	–	nvd
Packet Storm	📄 Pandora ITSM Authenticated Command Injection	7 Aug 202500:00	–	packetstorm
Positive Technologies	PT-2025-24699 · Unknown · Pandora Itsm	10 Jun 202500:00	–	ptsecurity
Rapid7 Blog	Metasploit Wrap-Up 08/08/25	8 Aug 202515:57	–	rapid7blog
RedhatCVE	CVE-2025-4653	12 Jun 202516:10	–	redhatcve

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "all"
    ],
    "product": "Pandora ITSM",
    "vendor": "Pandora FMS",
    "versions": [
      {
        "lessThan": "5.0.106",
        "status": "affected",
        "version": "5.0.105",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
pandorafms	www.pandorafms.com/en/security/common-vulnerabilities-and-exposures/

Parameter	Position	Path	Description	CWE
name	request body	pandoraitsm/index.php	Command injection via the backup name field in the backup creation flow (backup_manager) leading to RCE.	CWE-77

15 Apr 2026 00:35Current

7.1High risk

Vulners AI Score7.1

CVSS 47

EPSS0.63871

SSVC

CWE-77