Published: 15/02/2023 Updated: 18/10/2023

CVSS v3 Base Score: 4.8 | Impact Score: 2.7 | Exploitability Score: 1.7

VMScore: 0

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Artica PFMS Pandora FMS v765 on all platforms, allows Cross-Site Scripting (XSS). As a manager privilege user , create a network map containing name as xss payload. Once created, admin user must click on the edit network maps and XSS payload will be executed, which could be used for stealing admin users cookie value.

Vulnerable Product	Search on Vulmon	Subscribe to Product
pandorafms pandora fms 765

CVE-2022-45436 Reflected Cross Site Scripting leading to session hijacking in pandorafms <= Package v765 RRR > Exploit Title: Reflected Cross Site Scripting > Date: 15/02/2023 > Exploit Author: Damodar Naik > Vendor Homepage: pandorafmscom/en/ > Software Link: githubcom/pandorafms/pandorafms > Version: <

CWE-79 https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/https://gist.github.com/damodarnaik/ac07a179972cd4d508f246e9bc5500e7 https://nvd.nist.gov https://github.com/damodarnaik/CVE-2022-45436

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2022-45436

Vulnerability Summary

Vulnerability Trend

Github Repositories

References

Vulmon Search

About

Products

Connect