EUVD-2026-21994
GHSA-4g9c-4vrc-qw29
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:A/V:D/RE:L/U:Amber
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation vulnerability allows Stored Cross-Site Scripting via event comments. This issue affects Pandora FMS: from 777 through 800
AnalysisAI
Stored Cross-Site Scripting (XSS) in Pandora FMS versions 777 through 800 allows authenticated users with low privileges to inject malicious scripts via event comments, which execute in the browsers of other users viewing those comments. The vulnerability has a CVSS score of 2.1 with low confidentiality and integrity impact, requiring user interaction and attack preparation time to exploit. No public exploit code or active exploitation has been identified.
Technical ContextAI
This vulnerability stems from improper input neutralization (CWE-79) in the web page generation logic of Pandora FMS, specifically in the event comments feature. The root cause is the failure to properly encode or sanitize user-supplied input before rendering it in HTML responses. Pandora FMS is an open-source monitoring and management platform written primarily in PHP; the vulnerability lies in the comment processing mechanism that allows authenticated users to submit event comments without adequate output encoding. When these comments are displayed to other users, the injected JavaScript payload executes in their browser context, potentially allowing session hijacking, credential theft, or malicious actions performed on behalf of the victim user.
RemediationAI
Upgrade Pandora FMS to a version released after 800. Users unable to immediately upgrade should restrict comment functionality to trusted administrators only or disable event comments entirely until patching is completed. Apply the official security patch from Pandora FMS by reviewing the vendor advisory at https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/ for the specific patched version number. Additionally, implement input validation on the server side to reject or sanitize HTML and JavaScript characters in event comment submissions, and ensure output encoding is applied when rendering comments in web pages.
More in Pandora Fms
View allPandora FMS monitoring platform versions 700 through 777.6 contain a command injection vulnerability that allows OS comm
Improper Neutralization of Special Elements in the Netflow directory field may allow OS command injection. This issue af
Authenticated command injection in Pandora FMS 7.0NG and earlier allows remote code execution via the net_tools.php ping
Artica Pandora FMS 7.44 allows remote command execution via the events feature. Rated high severity (CVSS 8.8), this vul
Arbitrary commands execution on the server by exploiting a command injection vulnerability in the LDAP authentication me
PandoraFMS <=7.54 allows arbitrary file upload, it leading to remote command execution via the File Manager. Rated criti
A SQL injection vulnerability in the pandora_console component of Artica Pandora FMS 742 allows an unauthenticated attac
Artica Pandora FMS 742 allows unauthenticated attackers to perform Phar deserialization. Rated critical severity (CVSS 9
Artica Pandora FMS before 743 allows unauthenticated attackers to conduct SQL injection attacks via the pandora_console/
Artica Pandora FMS 7.44 allows privilege escalation. Rated critical severity (CVSS 9.8), this vulnerability is remotely
Pandora FMS 7.0 NG <= 746 suffers from Multiple XSS vulnerabilities in different browser views. Rated critical severity
Artica Pandora FMS 7.44 has inadequate access controls on a web folder. Rated high severity (CVSS 7.5), this vulnerabili
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today