CVE Feed

    Dashboard / CVE / CVE-2026-64946

    CVE-2026-64946

    A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltration and administrator account takeover. This issue affects Pandora FMS: from 777 onwards.

    Published:Oct 1, 2026
    Last Modified:Oct 1, 2026
    EPS:Oct 1, 2026
    EPSS Score:
    CVSS Score:7.4

    Affected Products

    Vendor
    Pandora Fms
    Product
    Pandora Fms

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-75786 (CVSS 7.2) — Unsanitized concatenation of the module parameter in the Grafana datasource endpoint allows authenticated blin…
    CVE-2026-64950 (CVSS 8.4) — Missing input validation and output encoding on the directory name parameter in File Manager's Create Director…
    CVE-2026-64949 (CVSS 8.6) — Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitra…
    CVE-2026-64948 (CVSS 7.1) — Missing authorization in module data retrieval allows unauthorized cross-group access to module history. Affec…
    CVE-2026-64947 (CVSS 7.5) — A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker…
    CVE-2026-34190 (CVSS 5.9) — Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of alert commands via sequential,…
    CVE-2026-34189 (CVSS 5.9) — Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of event responses via a forged G…
    CVE-2026-34187 (CVSS 7.6) — Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via grap…
    CVE-2026-30810 (CVSS 7.1) — Server-Side Request Forgery vulnerability allows Privilege Escalation via API Checker extension. This issue af…
    CVE-2026-30808 (CVSS 7.6) — Session Fixation vulnerability allows Session Hijacking via crafted session ID. This issue affects Pandora FMS…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High