The vulnerability arises from improper neutralization of user-supplied input when rendering event comments in Pandora FMS, enabling an attacker to inject and store malicious scripts that will execute in the browser context of any user who views the affected comment. This stored XSS flaw is tagged as CWE‑79 and can facilitate client‑side attacks such as session hijacking, defacement, or the delivery of malicious content. The impact is confined to users who access the edited event comments; it does not provide direct server‑side code execution or privilege escalation.

Pandora FMS is affected by this defect. The flaw exists in all releases from version 777 up through 800 inclusive. Versions v800.1 and later include the vendor’s fix and are not impacted.

The officially assigned CVSS score is 2.1, indicating low overall severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through a web browser accessed by users having permission to view event comments. Successful exploitation requires an attacker to obtain write access to the comment field or otherwise insert malicious payloads, after which the payload will be served to other users. While the probability of exploitation may be moderate in environments with weak input validation policies, the overall risk remains low due to the need for user interaction.