1080 matches found
CVE-2014-125124
Summary: CVE-2014-125124 affects Pandora FMS
PT-2025-31544 · Undefined · Undefined
An unauthenticated remote command execution vulnerability exists in Pandora FMS versions up to and including 5.0RC1 via the Anyterm web interface, which listens on TCP port 8023. The anyterm-module endpoint accepts unsanitized user input via the p parameter and directly injects it into a shell...
CVE-2014-125115
An unauthenticated SQL injection vulnerability exists in Pandora FMS version 5.0 SP2 and earlier. The mobile/index.php endpoint fails to properly sanitize user input in the loginhashdata parameter, allowing attackers to extract administrator credentials or active session tokens via crafted...
CVE-2014-125115
CVE-2014-125115 affects Pandora FMS up to version 5.0 SP2. The mobile/index.php loginhash_data input is unsafely concatenated into SQL, enabling unauthenticated SQL injection to extract administrator credentials or session tokens. After bypassing authentication, a second vulnerability in the File...
CVE-2014-125115 Pandora FMS ≤ 5.0 SP2 Default Credential SQL Injection RCE
An unauthenticated SQL injection vulnerability exists in Pandora FMS version 5.0 SP2 and earlier. The mobile/index.php endpoint fails to properly sanitize user input in the loginhashdata parameter, allowing attackers to extract administrator credentials or active session tokens via crafted...
PT-2025-31206 · Undefined · Undefined
An unauthenticated SQL injection vulnerability exists in Pandora FMS version 5.0 SP2 and earlier. The mobile/index.php endpoint fails to properly sanitize user input in the loginhash data parameter, allowing attackers to extract administrator credentials or active session tokens via crafted...
Pandora FMS 安全漏洞
Pandora FMS is a monitoring system from Pandora FMS, USA. The system monitors networks, servers, virtual infrastructures, applications, etc. in a visual way. A security vulnerability exists in Pandora FMS 5.0 SP2 and prior versions, which stems from the loginhashdata parameter not being properly...
Metasploit Weekly Wrap-Up 07/18/2025
ARM64 Windows Payload This latest metasploit-framework release marks a significant milestone, introducing the inaugural payload specifically designed for Windows ARM64 architecture: windows/aarch64/exec. This addition greatly expands the framework's capabilities, enabling penetration testers and...
CVE-2025-34088
An authenticated remote code execution vulnerability exists in Pandora FMS version 7.0NG and earlier. The nettools.php functionality allows authenticated users to execute arbitrary OS commands via the selectips parameter when performing network tools operations, such as pinging. This occurs becau...
CVE-2025-34088
An authenticated remote code execution vulnerability exists in Pandora FMS version 7.0NG and earlier. The nettools.php functionality allows authenticated users to execute arbitrary OS commands via the selectips parameter when performing network tools operations, such as pinging. This occurs becau...
CVE-2025-34088
An authenticated remote code execution vulnerability exists in Pandora FMS version 7.0NG and earlier. The nettools.php functionality allows authenticated users to execute arbitrary OS commands via the selectips parameter when performing network tools operations, such as pinging. This occurs becau...
CVE-2025-34088 Pandora FMS Authenticated Remote Code Execution via Ping Module
An authenticated remote code execution vulnerability exists in Pandora FMS version 7.0NG and earlier. The nettools.php functionality allows authenticated users to execute arbitrary OS commands via the selectips parameter when performing network tools operations, such as pinging. This occurs becau...
CVE-2025-34088 Pandora FMS Authenticated Remote Code Execution via Ping Module
An authenticated remote code execution vulnerability exists in Pandora FMS version 7.0NG and earlier. The nettools.php functionality allows authenticated users to execute arbitrary OS commands via the selectips parameter when performing network tools operations, such as pinging. This occurs becau...
CVE-2025-34088
Summary: Pandora FMS 7.0NG and earlier expose an authenticated remote code execution via the net_tools.php module, specifically the select_ips parameter used in network tools (e.g., ping). This occurs because unsanitized input is passed to system commands, enabling command injection. Public refer...
PT-2025-27828 · Unknown · Pandora Fms
Name of the Vulnerable Software and Affected Versions: Pandora FMS versions 7.0NG and earlier Description: An authenticated remote code execution issue exists, allowing authenticated users to execute arbitrary OS commands via the select ips parameter in the "net tools.php" functionality when...
Pandora FMS 安全漏洞
Pandora FMS is a monitoring system from Pandora FMS, USA. The system monitors networks, servers, virtual infrastructures, applications, etc. through visualization. A security vulnerability exists in Pandora FMS 7.0NG and prior versions, which stems from the nettools.php function that allows...
CVE-2025-5306
Improper Neutralization of Special Elements in the Netflow directory field may allow OS command injection. This issue affects Pandora FMS 774 through 778...
CVE-2025-5306
Improper Neutralization of Special Elements in the Netflow directory field may allow OS command injection. This issue affects Pandora FMS 774 through 778...