CVE-2022-45436

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Artica PFMS Pandora FMS v765 on all platforms, allows Cross-Site Scripting (XSS). As a manager privilege user , create a network map containing name as xss payload. Once created, admin user must click on the edit network maps and XSS payload will be executed, which could be used for stealing admin users cookie value.

• CWE-79
• CWE-79

• https://gist.github.com/damodarnaik/ac07a179972cd4d508f246e9bc5500e7
• https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/Vendor Advisory
• https://gist.github.com/damodarnaik/ac07a179972cd4d508f246e9bc5500e7
• https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/Vendor Advisory

Published

Feb 15, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-45430Some Dahua software products have a vulnerability of unauthe…3.7
• CVE-2022-45431Some Dahua software products have a vulnerability of unauthe…7.5
• CVE-2022-45432Some Dahua software products have a vulnerability of unauthe…5.3
• CVE-2022-45433Some Dahua software products have a vulnerability of unauthe…3.7
• CVE-2022-45434Some Dahua software products have a vulnerability of unauthe…5.9
• CVE-2022-45435IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p2, Iden…6.5
• CVE-2022-45437Improper Neutralization of Input During Web Page Generation …4.8
• CVE-2022-45438When explicitly enabling the feature flag DASHBOARD_CACHE (d…5.3
• CVE-2022-45439A pair of spare WiFi credentials is stored in the configurat…6.5
• CVE-2022-4544The MashShare WordPress plugin before 3.8.7 does not validat…5.4
• CVE-2022-45440A vulnerability exists in the FTP server of the Zyxel AX7501…4.4
• CVE-2022-45441A cross-site scripting (XSS) vulnerability in Zyxel NBG-418N…6.1