Pandora FMS 7.0 NG <= 746 suffers from Multiple XSS vulnerabilities in different browser views.

published 2020-07-13 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-4091

cvss: 9.0; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 16.2%; EPSS 16.2% chance of exploitation in 30 days, percentile 96%
public exploits: 1; Exploit-DB

Pandora FMS 7.0 NG <= 746 suffers from Multiple XSS vulnerabilities in different browser views. A network administrator scanning a SNMP device can trigger a Cross Site Scripting (XSS), which can run arbitrary code to allow Remote Code Execution as root or apache2.

Timeline

2020-07-13 Published
2020-07-26 First public exploit (EDB-48707)

Exploit prediction

16.23% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

EDB-48707 PandoraFMS 7.0 NG 746 - Persistent Cross-Site Scripting webapps, 2020-07-26
packetstormsecurity.com https://packetstormsecurity.com/files/158389/Pandora-FMS-7.0-NG-746-Script-Insertion-Code-Execution.htmlPoC referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.1	9.0	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
NVD	2.0	8.5	AV:N/AC:M/Au:S/C:C/I:C/A:C

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

packetstormsecurity.com /files/158389/Pandora-FMS-7.0-NG-746-Script-Insertion-Code-Execution.htmlPoC
exploit, third-party-advisory, vdb-entry
exploit-db.com /exploits/48707
exploit, third-party-advisory, vdb-entry
pandorafms.com /downloads/whats-new-747-EN.pdf
release-notes, vendor-advisory
medium.com /%40tehwinsam/multiple-xss-on-pandorafms-7-0-ng-744-64b244b8523c

Sources

CVE List CVE-2020-11749
NVD CVE-2020-11749

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary