HIGH 7.4 NVD

CVE-2026-64946

A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltratio

A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltration and administrator account takeover. This issue affects Pandora FMS: from 777 onwards.

References

https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/

Published: 2026-10-01 · Source: NVD · Feed updated: 2026-10-01

This high severity vulnerability with a CVSS score of 7.4 was published on 2026-10-01 via NVD.

vulnfeed aggregates 12641 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.