CVE-2022-43979

There is a Path Traversal that leads to a Local File Inclusion in Pandora FMS v764. A function is called to check that the parameter that the user has inserted does not contain malicious characteres, but this check is insufficient. An attacker could insert an absolute path to overcome the heck, thus being able to incluse any PHP file that resides on the disk. The exploitation of this vulnerability could lead to a remote code execution.

• CWE-434
• CWE-22

• https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/Vendor Advisory
• https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/Vendor Advisory

Published

Jan 27, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-43973An arbitrary code execution vulnerability exisits in Linksys…7.2
• CVE-2022-43974MatrixSSL 4.0.4 through 4.5.1 has an integer overflow in mat…9.8
• CVE-2022-43975An issue was discovered in FC46-WebBridge on GE Grid Solutio…7.5
• CVE-2022-43976An issue was discovered in FC46-WebBridge on GE Grid Solutio…9.8
• CVE-2022-43977An issue was discovered on GE Grid Solutions MS3000 devices …9.8
• CVE-2022-43978There is an improper authentication vulnerability in Pandora…3.7
• CVE-2022-4398Integer Overflow or Wraparound in GitHub repository radareor…7.8
• CVE-2022-43980There is a stored cross-site scripting vulnerability in Pand…5.4
• CVE-2022-43982In Apache Airflow versions prior to 2.4.2, the "Trigger DAG …6.1
• CVE-2022-43983Browsershot version 3.57.2 allows an external attacker to re…8.2
• CVE-2022-43984Browsershot version 3.57.3 allows an external attacker to re…8.2
• CVE-2022-43985In Apache Airflow versions prior to 2.4.2, there was an open…6.1