CVE-2021-32099

CRITICAL 9.8CVE-2021-32099 · Published 07/05/2021 · updated 17/06/2026

Package	Affected versions	Patched versions
pandora fms artica	`= 742`	No fix yet

Description

A SQL injection vulnerability in the pandora_console component of Artica Pandora FMS 742 allows an unauthenticated attacker to upgrade his unprivileged session via the /include/chart_generator.php session_id parameter, leading to a login bypass.

References

blog.sonarsource.com/pandora-fms-742-critical-code-vulnerabilities-explained · Exploit
pandorafms.com/blog/whats-new-in-pandora-fms-743 · Release Notes
portswigger.net/daily-swig/multiple-vulnerabilities-in-pandora-fms-could-trigger-remote-execution-attack · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free