CVE-2021-32099

A SQL injection vulnerability in the pandora_console component of Artica Pandora FMS 742 allows an unauthenticated attacker to upgrade his unprivileged session via the /include/chart_generator.php session_id parameter, leading to a login bypass.

• CWE-89

• https://blog.sonarsource.com/pandora-fms-742-critical-code-vulnerabilities-explainedExploit, Third Party Advisory
• https://pandorafms.com/blog/whats-new-in-pandora-fms-743/Release Notes, Vendor Advisory
• https://portswigger.net/daily-swig/multiple-vulnerabilities-in-pandora-fms-could-trigger-remote-execution-attackExploit, Third Party Advisory
• https://blog.sonarsource.com/pandora-fms-742-critical-code-vulnerabilities-explainedExploit, Third Party Advisory
• https://pandorafms.com/blog/whats-new-in-pandora-fms-743/Release Notes, Vendor Advisory
• https://portswigger.net/daily-swig/multiple-vulnerabilities-in-pandora-fms-could-trigger-remote-execution-attackExploit, Third Party Advisory

Published

May 7, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-32092A Cross-site scripting (XSS) vulnerability in the DocumentAc…6.1
• CVE-2021-32093The ConfigFileAction component of U.S. National Security Age…6.5
• CVE-2021-32094U.S. National Security Agency (NSA) Emissary 5.9.0 allows an…8.8
• CVE-2021-32095U.S. National Security Agency (NSA) Emissary 5.9.0 allows an…8.1
• CVE-2021-32096The ConsoleAction component of U.S. National Security Agency…8.8
• CVE-2021-32098Artica Pandora FMS 742 allows unauthenticated attackers to p…9.8
• CVE-2021-3210components/Modals/HelpTexts/GenericAll/GenericAll.jsx in Blo…9.6
• CVE-2021-32100A remote file inclusion vulnerability exists in Artica Pando…6.5
• CVE-2021-32101The Patient Portal of OpenEMR 5.0.2.1 is affected by a incor…8.2
• CVE-2021-32102A SQL injection vulnerability exists (with user privileges) …8.8
• CVE-2021-32103A Stored XSS vulnerability in interface/usergroup/usergroup_…4.8
• CVE-2021-32104A SQL injection vulnerability exists (with user privileges) …8.8