The default configuration of Pandora FMS 3.1 and earlier specifies an empty string for the loginhashpwd field, which allows remote attackers to bypass authentication by sending a request to index.php with "admin" in the loginhashuser parameter, in conjunction with the md5 hash of "admin" in the loginhashdata parameter.

operation/agentes/networkmap.php in Pandora FMS before 3.1.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the layout parameter in an operation/agentes/networkmap action to index.php.

Multiple SQL injection vulnerabilities in Pandora FMS before 3.1.1 allow remote authenticated users to execute arbitrary SQL commands via (1) the idgroup parameter in an operation/agentes/veragente action to ajax.php or (2) the groupid parameter in an operation/agentes/estadoagente action to index.php, related to operation/agentes/estadoagente.php.

Multiple directory traversal vulnerabilities in Pandora FMS before 3.1.1 allow remote attackers to include and execute arbitrary local files via (1) the page parameter to ajax.php or (2) the id parameter to general/pandorahelp.php, and allow remote attackers to include and execute, create, modify, or delete arbitrary local files via (3) the layout parameter to operation/agentes/networkmap.php.

Incomplete blacklist vulnerability in the safeurlextraclean function in ajax.php in Pandora FMS before 3.1.1 allows remote attackers to execute arbitrary PHP code by using a page parameter containing a UNC share pathname, which bypasses the check for the : (colon) character.

PHP remote file inclusion vulnerability in extras/pandoradiag.php in Pandora FMS before 3.1.1 allows remote attackers to execute arbitrary PHP code via a URL in the argv[1] parameter.