PPandora FMS

Products

Exploited and recent CVEs

• CVE-2026-75786 High 7.2 SQL Injection in Grafana Integration Endpoint (query.php) 0.2%
• CVE-2026-64950 High 8.4 Stored Cross-Site Scripting via Directory Name in File Manager Create Directory 0.2%
• CVE-2026-64949 High 8.6 Unrestricted File Upload Leading to Remote Code Execution in Admin Tools File Manager 0.3%
• CVE-2026-64948 High 7.1 Missing Authorization in get_module_detail AJAX Endpoint Allows Cross-Group Module Data Disclosure 0.2%
• CVE-2026-64947 High 7.5 CSRF Bypass Leading to Remote Code Execution via Unrestricted File Upload in Plugin File Manager 0.3%
• CVE-2026-64946 High 7.4 CSRF Bypass Leading to Stored Cross-Site Scripting via Unrestricted SVG Upload in File Manager 0.2%
• CVE-2026-34190 Medium 5.9 CSRF in Alert Command Deletion 0.2%
• CVE-2026-34189 Medium 5.9 CSRF in Event Response Deletion 0.2%
• CVE-2026-34187 High 7.6 SQL Injection in Graph Container Parameter 0.3%
• CVE-2026-30810 High 7.1 Server-Side Request Forgery in API Checker leads to Privilege Escalation 0.3%
• CVE-2026-30808 High 7.6 Session Fixation in Authentication leads to Session Hijacking 0.3%
• CVE-2026-30807 High 7.1 Cross-Site Request Forgery on Extension Pages 0.1%
• CVE-2026-30805 Critical 9.1 Insecure Default Initialization in API Authentication leads to Authentication Bypass 0.3%
• CVE-2026-34188 High 7.5 OS Command Injection in Event Response Execution 1.1%
• CVE-2026-34186 High 8.7 SQL Injection in Custom Fields leads to Database Compromise 0.2%
• CVE-2026-30813 High 8.7 SQL Injection in Module Search leads to Database Compromise 0.3%
• CVE-2026-30812 Low 2.1 Stored Cross-Site Scripting in Event Comments via Filter Bypass 0.2%
• CVE-2026-30811 High 8.4 Missing Authorization in Configuration Ajax Endpoint leads to Information Disclosure 0.3%
• CVE-2026-30809 High 8.7 OS Command Injection in WebServerModuleDebug via Blacklist Bypass leads to Remote Code Execution 0.9%
• CVE-2026-30806 High 8.7 OS Command Injection in Network Report leads to Remote Code Execution 0.9%
• CVE-2026-30804 High 8.6 Unrestricted File Upload in Extension Uploader leads to Remote Code Execution 0.4%
• CVE-2025-5306 High 7.0 Command Injection in Netflow path 35.7%
• CVE-2025-4678 High 7.0 Remote Code Execution leads to Command Injection 1.5%
• CVE-2025-4653 High 7.0 Remote Code Execution leads to Command Injection 3.4%
• CVE-2024-12992 High 8.6 Remote Code Execution leads to Command Injection 1.2%
• CVE-2024-12971 High 8.6 QuickShell Authenticated Command Injection 61.5%
• CVE-2024-11320 Medium 6.9 Command Injection leading to RCE via LDAP Misconfiguration 91.2%
• CVE-2024-35308 High 8.3 Post-auth Arbitrary File Read in the Server Plugins Section 0.6%
• CVE-2024-9987 High 8.6 SQL Injection in CSV Module Data Collection 0.4%
• CVE-2024-35307 Critical 9.4 Argument Injection Leading to Remote Code Execution in Realtime Graph Extension 0.9%