CVE-2025-5306: falha de alta gravidade em Pandora FMS
Command Injection in Netflow path
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
48Vexday Risk Score
Corrija em breve. Ela tem exploit funcional público.
ssvc Attendcvss 7epss 36%
da publicação à armano mesmo dia
Publicada no NVD27 de jun.
metasploit27 de jun.
Improper Neutralization of Special Elements in the Netflow directory field may allow OS command injection. This issue affects Pandora FMS 774 through 778
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:L/S:N/AU:N/R:U/V:D/RE:M/U:Green
Produtos afetados
Pandora FMS · Pandora FMSCVEs relacionadas — Pandora FMS
No mesmo produto, das mais perigosas para as menos.
CVE-2024-11320MEDIUMCommand Injection leading to RCE via LDAP MisconfigurationEPSS 91.2%CVE-2024-12971HIGHQuickShell Authenticated Command InjectionEPSS 61.5%CVE-2024-12992HIGHRemote Code Execution leads to Command InjectionEPSS 1.2%CVE-2026-34188HIGHOS Command Injection in Event Response ExecutionEPSS 1.1%CVE-2024-35304CRITICALSystem command injection through Netflow functionEPSS 1.1%CVE-2026-30809HIGHOS Command Injection in WebServerModuleDebug via Blacklist Bypass leads to Remote Code ExecutionEPSS 1.0%