CVE-2022-47373: Pandorafms Pandora Fms

Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days.

Reflected Cross Site Scripting in Search Functionality of Module Library in Pandora FMS Console v766 and lower. This vulnerability arises on the forget password functionality in which parameter username does not proper input validation/sanitization thus results in executing malicious JavaScript payload.

Affected products

• Pandorafms Pandora Fms: up to and including 766

Published 2023-02-15. Last modified 2026-06-17.