CVE-2026-64950 Stored Cross-Site Scripting via Directory Name in File Manager Create Directory

Missing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows stored XSS, executing without user interaction. Affects Pandora FMS from 777 onwards...

EUVD-2026-90599

Missing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows stored XSS, executing without user interaction. Affects Pandora FMS from 777 onwards...

CVE-2026-64949 Unrestricted File Upload Leading to Remote Code Execution in Admin Tools File Manager

Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files. Affects Pandora FMS from 777 onwards...

CVE-2026-64949 Unrestricted File Upload Leading to Remote Code Execution in Admin Tools File Manager

Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files. Affects Pandora FMS from 777 onwards...

CVE-2026-64949

Pandora FMS versions 777 onwards are susceptible to a vulnerability in the File Manager module caused by an incomplete extension blacklist . This flaw allows authenticated users to upload and execute arbitrary .phar files , potentially leading to unauthorized code execution. No specific remediati...

EUVD-2026-90598

Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files. Affects Pandora FMS from 777 onwards...

CVE-2026-64947 CSRF Bypass Leading to Remote Code Execution via Unrestricted File Upload in Plugin File Manager

A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP code, resulting in Remote Code Execution. This issue affects Pandora FMS: from 777 onwards...

EUVD-2026-90596

A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP code, resulting in Remote Code Execution. This issue affects Pandora FMS: from 777 onwards...

CVE-2026-64947 CSRF Bypass Leading to Remote Code Execution via Unrestricted File Upload in Plugin File Manager

A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP code, resulting in Remote Code Execution. This issue affects Pandora FMS: from 777 onwards...

CVE-2026-64947

The Pandora FMS software, version 777 onwards , is vulnerable to a chained CSRF bypass and unrestricted file upload vulnerability within the Plugin File Manager . This flaw allows an attacker to upload and execute arbitrary PHP code , leading to Remote Code Execution (RCE) . No specific remediati...

EUVD-2026-90593

A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltration and administrator account takeover. This issue affects Pandora FMS: from 777 onwards...

CVE-2026-64946 CSRF Bypass Leading to Stored Cross-Site Scripting via Unrestricted SVG Upload in File Manager

A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltration and administrator account takeover. This issue affects Pandora FMS: from 777 onwards...

CVE-2026-64946 CSRF Bypass Leading to Stored Cross-Site Scripting via Unrestricted SVG Upload in File Manager

A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltration and administrator account takeover. This issue affects Pandora FMS: from 777 onwards...

CVE-2026-64946

The Pandora FMS monitoring platform is affected by a chained vulnerability involving CSRF and unrestricted SVG file upload within the File Manager module . This flaw allows for stored Cross-Site Scripting (XSS) , which can be leveraged to exfiltrate session cookies and perform administrator accou...

CVE-2026-15983

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File/Directory Deletion in all versions up to, and including, 6.3.316. This is due to the supersaveform AJAX handler performing no capability check — allowing Subscriber-level authenticated users to create ...

CLEANSTART-2024-ML93442 Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 89

Security vulnerability affects the chromium package. Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 89...

CLEANSTART-2025-IL34570 arbitrary file deletion vulnerability in Gitea v1

Security vulnerability affects the gitea package. An arbitrary file deletion vulnerability in Gitea v1...

CLEANSTART-2024-PX18765 Use after free in File System API in Google Chrome prior to 92

Security vulnerability affects the chromium package. Use after free in File System API in Google Chrome prior to 92...

CVE-2026-15983 Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameter

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File/Directory Deletion in all versions up to, and including, 6.3.316. This is due to the supersaveform AJAX handler performing no capability check — allowing Subscriber-level authenticated users to create ...

CVE-2026-15983

The Super Forms – Drag & Drop Form Builder plugin for WordPress (all versions up to and including 6.3.316 ) is vulnerable to Arbitrary File/Directory Deletion . The root cause stems from a lack of capability checks in the super_save_form AJAX handler, allowing Subscriber-level authenticated users...