{"id":"CVE-2026-64946","published":"2026-10-01T10:17:15.763","lastModified":"2026-10-01T15:17:30.940","description":"A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltration and administrator account takeover. This issue affects Pandora FMS: from 777 onwards.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-79","CWE-352"],"vendors":[],"products":[],"references":[{"url":"https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}