Authenticated Blind SQL Injection in Pandora FMS by Grafana
CVE-2026-75786

7.2HIGH

Key Information:

Vendor

Pandora Fms

Status
Pandora Fms
Vendor
CVE Published:
1 October 2026

What is CVE-2026-75786?

The vulnerability in Pandora FMS stems from unsanitized concatenation of module parameters in the Grafana datasource endpoint, enabling authenticated users to execute blind SQL injection attacks. This flaw poses a risk to the integrity of the database and sensitive data. Users of Pandora FMS versions from 777 onwards are advised to assess their systems for exposure and implement necessary security measures.

Affected Version(s)

Pandora FMS all 777

References

https://pandorafms.com/en/security/common-vulnerabilities...

CVSS V4

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dhiyaneshwaran Balasubramaniam
.