Stored XSS in Pandora FMS Event Comments Allows Code Injection

Publication date: 2026-04-13

Last updated on: 2026-04-22

Assigner: Artica PFMS

Description

Improper Neutralization of Input During Web Page Generation vulnerability allows Stored Cross-Site Scripting via event comments. This issue affects Pandora FMS: from 777 through 800

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-13

Last Modified

2026-04-22

Generated

2026-07-06

AI Q&A

2026-04-13

EPSS Evaluated

2026-07-05

NVD

CVE-2026-30812

EUVD

EUVD-2026-21994

Affected Vendors & Products

Vendor	Product	Version / Range
artica	pandora_fms	From 777 (inc) to 800.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is an Improper Neutralization of Input During Web Page Generation, which allows Stored Cross-Site Scripting (XSS) via event comments in Pandora FMS versions from 777 through 800.

Impact Analysis

The vulnerability can allow attackers to inject malicious scripts into event comments, which are then stored and executed in the context of users viewing those comments. This can lead to unauthorized actions, data theft, or session hijacking for users interacting with the affected system.

Hi! I’m here to help you understand CVE-2026-30812. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70