CVE-2025-34088

HighCVSS 8.8/10Last modified Jul 14, 2026

Description

An authenticated remote code execution vulnerability exists in Pandora FMS version 7.0NG and earlier. The net_tools.php functionality allows authenticated users to execute arbitrary OS commands via the select_ips parameter when performing network tools operations, such as pinging. This occurs because user input is not properly sanitized before being passed to system commands, enabling command injection.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Jul 3, 2025
Last modified
Jul 14, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-340899.3An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility developed by Aexol Studio, iCVE-2025-34098.8A vulnerability classified as critical has been found in Nothings stb up to f056911. This affects the function stb_include_string. The manipCVE-2025-340937.5An authenticated command injection vulnerability exists in the Polycom HDX Series command shell interface accessible over Telnet. The lan trCVE-2025-340959.3An OS command injection vulnerability exists in Mako Server versions 2.5 and 2.6, specifically within the tutorial interface provided by theCVE-2025-340969.3A stack-based buffer overflow vulnerability exists in Easy File Sharing HTTP Server version 7.2. The flaw is triggered when a crafted POST rCVE-2025-340978.6An unrestricted file upload vulnerability exists in ProcessMaker versions prior to 3.5.4 due to improper handling of uploaded plugin archiveCVE-2025-340987.1A path traversal vulnerability exists in Riverbed SteelHead VCX appliances (confirmed in VCX255U 9.6.0a) due to improper input validation inCVE-2025-340999.3An unauthenticated command injection vulnerability exists in VICIdial versions 2.9 RC1 through 2.13 RC1, within the vicidial_sales_viewer.phCVE-2025-34108.8A vulnerability classified as critical was found in mymagicpower AIAS 20250308. This vulnerability affects unknown code of the file trainingCVE-2025-341009.3An unrestricted file upload vulnerability exists in BuilderEngine 3.5.0 via the integration of the elFinder 2.0 file manager and its use of CVE-2025-341019.3An unauthenticated command injection vulnerability exists in Serviio Media Server versions 1.4 through 1.8 on Windows, in the /rest/action ACVE-2025-341029.3A remote code execution vulnerability exists in CryptoLog (PHP version, discontinued since 2009) due to a chained exploitation of SQL inject
CVE-2025-34088: High severity, CVSS 8.8 | Vulnix