Pandora FMS 7.0 NG 723

PandoraFMS <=7.54 allows Stored XSS by placing a payload in the name field of a visual console. When a user or an administrator visits the console, the XSS payload will be executed.

PandoraFMS 742 suffers from multiple XSS vulnerabilities, affecting the Agent Management, Report Builder, and Graph Builder components. An authenticated user can inject dangerous content into a data store that is later read and included in dynamic content.

Improper Access Control in Configuration (Credential store)

Cross-site scripting vulnerability in the network maps edit functionality

Stored Cross Site-Scripting in File Manager

Stored Cross Site-Scripting in Agent Manager