CVE-2026-75786

Unsanitized concatenation of the module parameter in the Grafana datasource endpoint allows authenticated blind SQL injection. Affects Pandora FMS from 777 onwards.

Score

CVSS 4.0 7.2 High

Status

Deferred - security@pandorafms.com

Published

2026-10-01

Last modified

2026-10-01

Weaknesses

CWE-89

Affected products

• Pandora Fms (Pandora Fms)

References

• https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/