3973 matches found
Linux Distros Unpatched Vulnerability : CVE-2023-39511
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting XSS Vulnerability...
Malicious code in test-mlw2-seric-cacti-video-axoid (npm)
The package test-mlw2-seric-cacti-video-axoid was found to contain malicious code...
MAL-2025-36207 Malicious code in test-mlw2-seric-cacti-video-axoid (npm)
The package test-mlw2-seric-cacti-video-axoid was found to contain malicious code...
Linux Distros Unpatched Vulnerability : CVE-2025-24368
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cacti is an open source performance and fault management framework. Some of the data stored in automationtreerules.php is not thoroughly checked and is used to...
Linux Distros Unpatched Vulnerability : CVE-2024-43364
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cacti is an open source performance and fault management framework. The title parameter is not properly sanitized when saving external links in links.php...
Linux Distros Unpatched Vulnerability : CVE-2024-43365
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cacti is an open source performance and fault management framework. Theconsolenewsection parameter is not properly sanitized when saving external links in...
Exploit for Incorrect Authorization in Cacti
CVE-2022-46169 This exploit is a modified version from the ori...
CVE-2025-49223
billboard.js before 3.15.1 was discovered to contain a prototype pollution via the function generate, which could allow attackers to execute arbitrary code or cause a Denial of Service DoS via injecting arbitrary properties...
CVE-2024-30268
Cacti provides an operational monitoring and fault management framework. A reflected cross-site scripting vulnerability on the 1.3.x DEV branch allows attackers to obtain cookies of administrator and other users and fake their login using obtained cookies. This issue is fixed in commit...
CVE-2022-48547
A reflected cross-site scripting XSS vulnerability in Cacti 0.8.7g and earlier allows unauthenticated remote attackers to inject arbitrary web script or HTML in the "ref" parameter at authchangepassword.php...
CVE-2022-48538
In Cacti 1.2.19, there is an authentication bypass in the web login functionality because of improper validation in the PHP code: cactildapauth allows a zero as the password...
Gentoo Linux Security Advisory 201607-05
Gentoo Linux Security Advisory 201607-05 - Multiple vulnerabilities have been found in Cacti, the worst of which could lead to the remote execution of arbitrary code. Versions less than 0.8.8h are affected...
Gentoo Linux Security Advisory 200506-20
Gentoo Linux Security Advisory 200506-20 - Cacti is vulnerable to several SQL injection, authentication bypass and file inclusion vulnerabilities. Versions less than 0.8.6f are affected...
CVE-2022-41444
Cross Site Scripting XSS vulnerability in Cacti 1.2.21 via crafted POST request to graphsnew.php...
CVE-2020-7058
datainput.php in Cacti 1.2.8 allows remote code execution via a crafted Input String to Data Collection - Data Input Methods - Unix - Ping Host. NOTE: the vendor has stated "This is a false alarm...
CVE-2013-3512
The Cacti component in GroundWork Monitor Enterprise 6.7.0 does not properly perform authorization checks, which allows remote authenticated users to read or modify configuration settings via unspecified vectors, as demonstrated by reading credentials...
CVE-2017-16661
Cacti 1.1.27 allows remote authenticated administrators to read arbitrary files by placing the Log Path into a private directory, and then making a clog.php?filename= request, as demonstrated by filename=passwd with a Log Path under /etc to read /etc/passwd...
CVE-2017-16660
Cacti 1.1.27 allows remote authenticated administrators to conduct Remote Code Execution attacks by placing the Log Path under the web root, and then making a remoteagent.php request containing PHP code in a Client-ip header...