CVE-2018-11223: Pandorafms Artica Pandora Fms

Medium severity, CVSS 5.4. EPSS: 1.3% chance of exploitation in the next 30 days.

XSS in Artica Pandora FMS before 7.0 NG 723 allows an attacker to execute arbitrary code via a crafted "refr" parameter in a "/pandora_console/index.php?sec=estado&sec2=operation/agentes/estado_agente&refr=" call.

Affected products

• Pandorafms Artica Pandora Fms: before 7.0_ng_723 (fixed in 7.0_ng_723)

Published 2018-06-16. Last modified 2026-06-17.