Stored Cross-Site Scripting in Pandora FMS Affected by Improper Input Neutralization
CVE-2026-30812

2.1LOW

Key Information:

Vendor

Pandora Fms

Status
Pandora Fms
Vendor
CVE Published:
13 April 2026

What is CVE-2026-30812?

An improper neutralization of input during web page generation in Pandora FMS allows for Stored Cross-Site Scripting through event comments. This vulnerability can enable attackers to inject malicious scripts into the application, potentially compromising user data and leading to extensive security breaches.

Affected Version(s)

Pandora FMS all 777 <= 800

References

https://pandorafms.com/en/security/common-vulnerabilities...

CVSS V4

Score:
2.1
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Pedro J. Núñez-Cacho Fuentes <tunelko@gmail.com>
.