Pandora Fms EUVD-2026-21994

The CVSS v4.0 score of 2.1 reflects low real-world risk despite the XSS classification. While CVSS vector shows attack vector Network (AV:N) and low attack complexity (AC:L), critical mitigating factors significantly reduce exploitability: authentication is required (PR:L), attack preparation time is needed (AT:P), and user interaction is mandatory (UI:P). The impact scope is isolated (S:N), affecting only low confidentiality and integrity with no availability impact (VA:N). The EPSS score is not provided, but the combination of low CVSS, no reported active exploitation (KEV status not indicated), and lack of public exploit code suggests this is a lower-priority vulnerability despite its XSS classification. Organizations should prioritize this below critical or high-severity vulnerabilities, but it should still be addressed in normal patch cycles given the stored nature of the XSS.

An authenticated user with low-level monitoring privileges submits a crafted event comment containing embedded JavaScript, such as a payload that exfiltrates session cookies. When another user (such as an administrator) views the event details page, the injected script executes in their browser, potentially capturing their session token or forcing them to perform administrative actions on behalf of the attacker. The exploit requires the victim to actively view the compromised event, making it suitable for targeted attacks against specific administrators.