CVE-2026-39938

Vulnerability Report: Cacti Unauthenticated RCE on Graph Image Researcher: K | Product: Cacti ≤ 1.2.30 | CVE: CVE-2026-39938 01 Vulnerability Summary Field| Value ---|--- Product| Cacti — The Complete RRDtool-based Graphing Solution Affected Versions| ≤ 1.2.30 Vulnerability Class| CWE-22: Path...

CVE-2022-46169

CVE-2022-46169 Exploit for CVE-2022-46169 Cacti versions before 1.2.3 Here remoteclientauthorized checks the clients hostname in poller table for entry function remoteclientauthorized // ... $clientaddr = getclientaddr; // ... $clientname = gethostbyaddr$clientaddr; // ... $pollers =...

CVE-2022-46169

CVE-2022-46169 Cacti Blind Remote Code Execution Pre-Auth Disclaimer This is for educational purposes only. I am not responsible for your actions. Use at your own discretion. Explanation This script bruteforces variables required to exploit this vulnerability. This exploit requires the following ...

By-Poloss..-..CVE-2026-39938

CVE-2026-39938: Cacti = 1.2.30 - Unauthenticated LFI Executive Summary Field| Value ---|--- CVE ID| CVE-2026-39938 CVSS Score| 9.8 Critical Affected Product| Cacti Affected Versions| = 1.2.30 Patched Version| 1.2.31 Fix Commit| 9871f0c Vulnerability Details Root Cause The vulnerability exists in...

CVE-2024-25641---Cacti

CVE-2024-25641---Cacti Cacti exploit...

CVE-2025-24367

CVE-2025-24367 CVE-2025-24367 - Cacti Authenticated Graph Template RCE...

CVE-2024-25641-Exploit-for-Cacti-1.2.26

CVE-2024-25641 Exploit for Cacti 1.2.26 Exploiting CVE-2024-25641 on Cacti 1.2.26. When a user is authenticated, an arbitrary file write vulnerability allows Remote Code Execution RCE. Overview This script automates the process of exploiting CVE-2024-25641 in Cacti 1.2.26. The vulnerability allow...

CVE-2022-46169-Cacti-v1.2.22-RCE

CVE-2022-46169-Cacti-v1.2.22...

CVE-2024-25641-RCE-Automated-Exploit-Cacti-1.2.26

CVE-2024-25641-RCE-Automated-Exploit-Cacti-1.2.26 Fully automated exploit for CVE-2024-25641. When a user is authenticated, Cacti version 1.2.26 is vulnerable to an arbitrary file write vulnerability, exploitable through the "Package Import" feature, allows authenticated users having the "Import...

CVE-2020-14295

CVE-2020-14295 CVE-2020-14295 proof of concept. The original post can be found at exploit-db. Install requirements python3 -m pip install -r requirements.txt Usage $ python3 cactisqlirce.py --help usage: cactisqlirce.py -h -t -u -p --lhost --lport Cacti 1.2.12 - SQL Injection / Remote Code...

CVE-2022-46169

CVE-2022-46169 — Cacti 1.2.22 Unauthenticated Command Injection Field| Details ---|--- Product| Cacti Affected version| 1.2.22 Vulnerability| Unauthenticated OS command injection CVE| CVE-2022-46169 CWE| CWE-77 — Command Injection Severity| Critical CVSS v3.1| 9.8 Attack vector| Network...

CVE-2022-46169

CVE-2022-46169 This repository contains a Proof of Concept PoC for CVE-2022-46169 - Unauthenticated RCE on Cacti = 1.2.22 by chaining an Authentication Bypass and a Command Injection, described by Sonar in this blog post. The same vulnerabilities were also discovered by: Steven Seeley mrme of...

CVE-2026-39902

Vulnerability Report: Authenticated RCE Data Input Researcher: K | Product: Cacti ≤ 1.2.30 01 Vulnerability Summary Field| Value ---|--- Product| Cacti — Complete RRDtool-based Graphing Solution Affected Versions| ≤ 1.2.30 Vulnerability Type| OS Command Injection CWE-78 Attack Vector| Network...

CVE-2022-46169-Cacti-1.2.22

CVE-2022-46169 This exploit is a modified version from the original script by @FredBrave and adapted by @arthurcortesr and @alv-david. Usage/Examples python3 CVE-2022-46169.py -u http://XX.XX.XX.XX --LHOST XX.XX.XX.XX --LPORT XXXX --host-id X --local-id X Expected results Testing hostid=X,...

CVE-2024-25641

CVE-2024-25641 Exploit Title: Cacti 1.2.26 - RCE Authenticated Date: 06/01/2025 Exploit Author: D3Ext Vendor Homepage: https://cacti.net/ Software Link: https://github.com/Cacti/cacti/archive/refs/tags/release/1.2.26.zip Version: 1.2.26 Tested on: Kali Linux 2024 CVE: CVE-2024-25641 Explanation...

CVE-2022-46169-CACTI-1.2.22

CVE-2022-46169-CACTI-1.2.22 This is a exploit of CVE-2022-46169 to cacti 1.2.22. This exploit allows through an RCE to obtain a reverse shell on your computer. Requirement optparse requests Usage On a port on your machine listen and then run the exploit as follows. python3 CVE-2022-46169.py -u...

CVE-2020-8813

CVE-2020-8813 Cacti v1.2.8 Unauthenticated Remote Code Execution Uses Python 3 Running without Docker: git clone https://github.com/hexcowboy/CVE-2020-8813.git && cd CVE-2020-8813 python3 -m venv env && source env/bin/activate pip install -r requirements.txt python exploit.py Running with Docker:...

CVE-2022-46169

CVE 2022-46169 This script exploits an unauthenticated command injection vulnerability in Cacti versions through 1.2.22 in order to achieve unauthenticated remote code execution and gain a reverse shell...

CVE-2022-46169_unauth_remote_code_execution

CVE-2022-46169 - Unauthenticated Remote Code Execution Cacti Unauthenticated Remote Code Execution through authentication bypass and command injection in Cacti 1.2.23 and 1.3.0 DISCLAIMER: This script is made to audit the security of systems. Only use this script on your own systems or on systems...

CVE-2024-29895

CVE-2024-29895 Cacti CVE-2024-29895 POC A command injection vulnerability allows any unauthenticated user to execute arbitrary command on the server when registerargcargv option of PHP is On. https://github.com/Cacti/cacti/security/advisories/GHSA-cr28-x256-xf5m Usage: app -m http://site.com/ -c...