The vulnerability is a SQL injection via the module search function in Pandora FMS. Improper neutralization of special elements in the SQL command allows attackers to inject arbitrary SQL statements. This flaw can be used to read, modify, or delete database contents, potentially leading to full database compromise. The weakness corresponds to CWE‑89 (SQL Injection).

The flaw affects all Pandora FMS releases from version 777 up to 800 inclusive. Versions 800.1 and 801 contain the fix. The affected vendor is Pandora FMS.

The reported CVSS score is 8.7, indicating a high severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting it is not known to be actively exploited in the wild. The attack vector can be inferred to be remote, as the module search endpoint is accessed over the network. An attacker only needs to supply a specially crafted search query; no authentication or special privileges are required according to the description, making the exploit straightforward for anyone with network access to the application.