CVE-2021-46681

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via module massive operation name field.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Artica PFMS	Pandora FMS	>= v756, <= v756

References

https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/Vendor Advisory
https://www.incibe.es/en/cve-assignment-publication/coordinated-cvesThird Party Advisory
https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/Vendor Advisory
https://www.incibe.es/en/cve-assignment-publication/coordinated-cvesThird Party Advisory

Timeline

Published: Aug 5, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-466869.8Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in acmailer CGI ver.4.0.3 and earlie CVE-2021-466874.9JFrog Artifactory prior to version 7.31.10 and 6.23.38 is vulnerable to Sensitive Data Exposure through the Project Administrator REST API. CVE-2021-466997.8A vulnerability has been identified in Simcenter Femap (All versions < V2022.1.1). Affected application contains a stack based buffer overfl CVE-2021-467006.5In libsixel 1.8.6, sixel_encoder_output_without_macro (called from sixel_encoder_encode_frame in encoder.c) has a double free.CVE-2021-467016.5PreMiD 2.2.0 allows unintended access via the websocket transport. An attacker can receive events from a socket and emit events to a socket,CVE-2021-467025.5Tor Browser 9.0.7 on Windows 10 build 10586 is vulnerable to information disclosure. This could allow local attackers to bypass the intended CVE-2021-467039.8In the IsolatedRazorEngine component of Antaris RazorEngine through 4.5.1-alpha001, an attacker can execute arbitrary .NET code in a sandbox CVE-2021-467049.8In GenieACS 1.2.x before 1.2.8, the UI interface API is vulnerable to unauthenticated OS command injection via the ping host argument (lib/u CVE-2021-467054.4A Insecure Temporary File vulnerability in grub-once of grub2 in SUSE Linux Enterprise Server 15 SP4, openSUSE Factory allows local attacker CVE-2021-467086.1The swagger-ui-dist package before 4.1.3 for Node.js could allow a remote attacker to hijack the clicking action of the victim. By persuadin CVE-2021-467096.1phpLiteAdmin through 1.9.8.2 allows XSS via the index.php newRows parameter (aka num or number).CVE-2021-467407.5The device authentication service module has a defect vulnerability introduced in the design process.Successful exploitation of this vulnera