CVE-2014-125115

CVE-2014-125115 affects Pandora FMS up to version 5.0 SP2. The mobile/index.php loginhash_data input is unsafely concatenated into SQL, enabling unauthenticated SQL injection to extract administrator credentials or session tokens. After bypassing authentication, a second vulnerability in the File...

PT-2025-31206 · Undefined · Undefined

An unauthenticated SQL injection vulnerability exists in Pandora FMS version 5.0 SP2 and earlier. The mobile/index.php endpoint fails to properly sanitize user input in the loginhash data parameter, allowing attackers to extract administrator credentials or active session tokens via crafted...

CVE-2014-125115: Use of Hard-coded Credentials

An unauthenticated SQL injection vulnerability exists in Pandora FMS version 5.0 SP2 and earlier. The mobile/index.php endpoint fails to properly sanitize user input in the loginhashdata parameter, allowing attackers to extract administrator credentials or active session tokens via crafted...

Pandora FMS 安全漏洞

Pandora FMS is a monitoring system from Pandora FMS, USA. The system monitors networks, servers, virtual infrastructures, applications, etc. in a visual way. A security vulnerability exists in Pandora FMS 5.0 SP2 and prior versions, which stems from the loginhashdata parameter not being properly...

Metasploit Weekly Wrap-Up 07/18/2025

ARM64 Windows Payload This latest metasploit-framework release marks a significant milestone, introducing the inaugural payload specifically designed for Windows ARM64 architecture: windows/aarch64/exec. This addition greatly expands the framework's capabilities, enabling penetration testers and...

CVE-2025-34088

An authenticated remote code execution vulnerability exists in Pandora FMS version 7.0NG and earlier. The nettools.php functionality allows authenticated users to execute arbitrary OS commands via the selectips parameter when performing network tools operations, such as pinging. This occurs becau...

CVE-2025-34088

An authenticated remote code execution vulnerability exists in Pandora FMS version 7.0NG and earlier. The nettools.php functionality allows authenticated users to execute arbitrary OS commands via the selectips parameter when performing network tools operations, such as pinging. This occurs becau...

CVE-2025-34088

An authenticated remote code execution vulnerability exists in Pandora FMS version 7.0NG and earlier. The nettools.php functionality allows authenticated users to execute arbitrary OS commands via the selectips parameter when performing network tools operations, such as pinging. This occurs becau...

CVE-2025-34088 Pandora FMS Authenticated Remote Code Execution via Ping Module

An authenticated remote code execution vulnerability exists in Pandora FMS version 7.0NG and earlier. The nettools.php functionality allows authenticated users to execute arbitrary OS commands via the selectips parameter when performing network tools operations, such as pinging. This occurs becau...

CVE-2025-34088 Pandora FMS Authenticated Remote Code Execution via Ping Module

An authenticated remote code execution vulnerability exists in Pandora FMS version 7.0NG and earlier. The nettools.php functionality allows authenticated users to execute arbitrary OS commands via the selectips parameter when performing network tools operations, such as pinging. This occurs becau...

CVE-2025-34088

Summary: Pandora FMS 7.0NG and earlier expose an authenticated remote code execution via the net_tools.php module, specifically the select_ips parameter used in network tools (e.g., ping). This occurs because unsanitized input is passed to system commands, enabling command injection. Public refer...

PT-2025-27828 · Unknown · Pandora Fms

Name of the Vulnerable Software and Affected Versions: Pandora FMS versions 7.0NG and earlier Description: An authenticated remote code execution issue exists, allowing authenticated users to execute arbitrary OS commands via the select ips parameter in the "net tools.php" functionality when...

Pandora FMS 安全漏洞

Pandora FMS is a monitoring system from Pandora FMS, USA. The system monitors networks, servers, virtual infrastructures, applications, etc. through visualization. A security vulnerability exists in Pandora FMS 7.0NG and prior versions, which stems from the nettools.php function that allows...

CVE-2025-34088: Improper Neutralization of Special Elements used in an OS Command

An authenticated remote code execution vulnerability exists in Pandora FMS version 7.0NG and earlier. The nettools.php functionality allows authenticated users to execute arbitrary OS commands via the selectips parameter when performing network tools operations, such as pinging. This occurs becau...

CVE-2025-5306

Improper Neutralization of Special Elements in the Netflow directory field may allow OS command injection. This issue affects Pandora FMS 774 through 778...

CVE-2025-5306

Improper Neutralization of Special Elements in the Netflow directory field may allow OS command injection. This issue affects Pandora FMS 774 through 778...

CVE-2025-5306

Improper Neutralization of Special Elements in the Netflow directory field may allow OS command injection. This issue affects Pandora FMS 774 through 778...

EUVD-2025-19256

Improper Neutralization of Special Elements in the Netflow directory field may allow OS command injection. This issue affects Pandora FMS 774 through 778...

CVE-2025-5306 Command Injection in Netflow path

Improper Neutralization of Special Elements in the Netflow directory field may allow OS command injection. This issue affects Pandora FMS 774 through 778...

CVE-2025-5306

CVE-2025-5306 describes a command-injection vulnerability in Pandora FMS, specifically in the Netflow component. The issue is triggered by improper neutralization of special elements in the Netflow directory field, affecting Pandora FMS versions 774–778. Connected sources confirm a concrete explo...