exploit-CVE-2020-5844

Exploit for CVE-2020-5844 Pandora FMS v7.0NG.742 - Remote Code Execution Like this repo? Give us a ⭐! For educational and authorized security research purposes only. Exploit Author @UNICORDev by @NicPWNs and @Dev-Yeoj Vulnerability Description...

CVE-2024-11320

CVE-2024-11320 Exploit for Pandora FMS Remote Code Execution CVE-2024-11320...

Pandora FMS <=7.0NG.722 - Remote Code Execution

Pandora FMS versions =7.0NG.722 are vulnerable to unauthenticated remote code execution by chaining an unrestricted file upload CVE-2018-11221 and a local file inclusion CVE-2018-11222. An attacker can upload a malicious PHP file as a plugin and execute it via LFI, leading to full compromise of t...

CVE-2021-32099

CVE-2021-32099 PoC This repository provides a Proof of Concept PoC exploit for the CVE-2021-32099 vulnerability, affecting Pandora FMS 742. The exploit shows how an unauthenticated attacker can leverage a SQL injection vulnerability to escalate an unprivileged session to an administrator-level...

CVE-2022-45436

CVE-2022-45436 Reflected Cross Site Scripting leading to session hijacking in pandorafms Exploit Title: Reflected Cross Site Scripting Date: 15/02/2023 Exploit Author: Damodar Naik Vendor Homepage: https://pandorafms.com/en/ Software Link: https://github.com/pandorafms/pandorafms Version: Tested...

pandorafms_7.44

Pandora FMS 7.44 CVE-2020-13851 Pandora FMS 7.44 CVE-2020-13851 RCE allows an authenticated user to achieve remote command execution via the events feature. Can be done with credentials or a PHP session cookie. Getting Started Executing program Using credentials python3 pandorafms7.44.py -t...

CVE-2021-32099

poc : http://127.0.0.1:8888/pandoraconsole/include/chartgenerator.php?sessionid=%27%20union%20SELECT%201,2,%27idusuario|s:5:%22admin%22;%27%20as%20data%20--%20SgGO https://blog.sonarsource.com/pandora-fms-742-critical-code-vulnerabilities-explained...

CVE-2021-32099_SQLi

CVE-2021-32099 SQLi Bypass login Useful when trying to read User Flag on Pandora.htb CVE-2021-32099 SQLi allow attacker bypass login. Target Exploit on: Pandora FMS v7.0NG.742FIXPERL2020 Analysis Read from cvedetail. We know endpoint of target:...

CVE-2021-32099

CVE-2021-32099 CVE-2021-32099 POC : http://localhost:8000/pandoraconsole/include/chartgenerator.php?sessionid=a%27%20UNION%20SELECT%20%27a%27,1,%27idusuario|s:5:%22admin%22;%27%20as%20data%20FROM%20tsessionsphp%20WHERE%20%271%27=%271 Deatil :...

CVE-2021-32099

CVE-2021-32099 pandora fms 742 sqli pre authentication POC http://localhost/pandoraconsole/include/chartgenerator.php?sessionid=a' UNION SELECT 'a',1,'idusuario|s:5:"admin";' as data FROM tsessionsphp WHERE '1'='1 URL Encoded...

CVE-2026-64948

Missing authorization in module data retrieval allows unauthorized cross-group access to module history. Affects Pandora FMS from 777 onwards...

CVE-2026-64949

Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files. Affects Pandora FMS from 777 onwards...

CVE-2026-64950

Missing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows stored XSS, executing without user interaction. Affects Pandora FMS from 777 onwards...

CVE-2026-75786

Unsanitized concatenation of the module parameter in the Grafana datasource endpoint allows authenticated blind SQL injection. Affects Pandora FMS from 777 onwards...

CVE-2026-34190

Cross-Site Request Forgery CSRF vulnerability allows unauthorized deletion of alert commands via sequential, unvalidated GET requests when an authenticated administrator visits a malicious page. This issue affects Pandora FMS: from 777 onwards...

CVE-2026-64946

A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltration and administrator account takeover. This issue affects Pandora FMS: from 777 onwards...

CVE-2026-64947

A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP code, resulting in Remote Code Execution. This issue affects Pandora FMS: from 777 onwards...

CVE-2026-34189

Cross-Site Request Forgery CSRF vulnerability allows unauthorized deletion of event responses via a forged GET request when an authenticated administrator visits a malicious page. This issue affects Pandora FMS: from 777 onwards...

CVE-2026-75786

The Pandora FMS software (version 777 onwards ) is vulnerable to an authenticated blind SQL injection due to the unsanitized concatenation of the module parameter in the Grafana datasource endpoint . This vulnerability allows an authenticated attacker to execute SQL commands against the backend d...

CVE-2026-75786 SQL Injection in Grafana Integration Endpoint (query.php)

Unsanitized concatenation of the module parameter in the Grafana datasource endpoint allows authenticated blind SQL injection. Affects Pandora FMS from 777 onwards...