An improperly neutralized special element in an SQL command allows attackers to inject malicious SQL via custom fields, potentially enabling them to read or alter the underlying database. The vulnerability could lead to data leakage, unauthorized writes, or complete loss of database integrity.

Pandora FMS products are affected, specifically versions from 777 through 800 inclusive. The vendor has addressed the issue in the 800.1 and 801 releases.

The CVSS score of 8.7 indicates a high severity risk. No EPSS score is provided, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is submitting malicious input through the web interface’s custom field functionality, which a remote attacker could exploit to gain unauthorized database access and potentially compromise the entire system.