CVE-2021-35501: PandoraFMS <=7.54 allows Stored XSS by placing a payload in the name field of a visual console.

Security readout for executives and security teams

PandoraFMS 7.54 and earlier can store malicious script in a visual console name. When another user or administrator opens that console, the script runs in their browser. For executives, the business risk is unauthorized action or data exposure inside a monitoring system, especially if privileged users view affected consoles. Exposure is likely limited to organizations running PandoraFMS 7.54 or earlier where users can create or modify visual console names. Risk increases if administrators routinely view user-created consoles or if the PandoraFMS instance is reachable by many internal users. Prioritize within the next remediation cycle, faster if PandoraFMS is broadly accessible or used by privileged operations teams. Stored XSS in monitoring platforms can become a control-plane risk. Mitigation focus: Check PandoraFMS vendor guidance for the fixed version or supported mitigation.; Upgrade PandoraFMS if vendor guidance identifies a patched release.; Restrict who can create or edit visual consoles..

Prepared

Jun 2, 2026, 19:19 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.