CVE-2021-36697
MediumCVSS 6.7Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
A vulnerability in Artica Pandora FMS up to version 755 allows an admin to overwrite the .htaccess file via the File Manager component. The new .htaccess contains a Rewrite Rule with a file type definition, enabling upload of a normal PHP file and code execution via an HTTP request.
Risk Assessment
The risk involves authenticated remote code execution by an admin, potentially leading to full server compromise and data breach.
Recommendation
Immediately upgrade Pandora FMS to a version newer than 755 and restrict admin privileges to the minimum necessary.
Other vulnerabilities in Pandora FMS
See all- CVE-2026-30810High
Server-Side Request Forgery vulnerability allows Privilege Escalation via API Checker extension. This issue affects Pandora FMS from versions 777 to 800.
- CVE-2026-30808High
Session Fixation vulnerability allows Session Hijacking via crafted session ID. This issue affects Pandora FMS: from 777 through 800.
- CVE-2026-34187Critical
CVE-2026-34187 is a vulnerability related to improper neutralization of special elements used in SQL commands, allowing SQL Injection via graph container parameter. This issue affects Pandora FMS versions from 777 to 800.
- CVE-2026-30805Critical
Insecure Default Initialization of Resource vulnerability allows Authentication Bypass via API access. This issue affects Pandora FMS from versions 777 through 800.
- CVE-2025-34088High
An authenticated remote code execution vulnerability exists in Pandora FMS version 7.0NG and earlier. The net_tools.php script fails to sanitize the select_ips parameter before passing it to system commands, allowing command injection.
- CVE-2021-36698Medium
An XSS vulnerability in Pandora FMS up to version 755 allows an attacker to inject malicious script by creating a new event filter with a crafted name.
Original NVD description (English source)
With an admin account, the .htaccess file in Artica Pandora FMS <=755 can be overwritten with the File Manager component. The new .htaccess file contains a Rewrite Rule with a type definition. A normal PHP file can be uploaded with this new "file type" and the code can be executed with an HTTP request.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS