The vulnerability of the Cacti network monitoring software lies in the lack of security measures taken to protect the structure of the web page. This allows attackers to execute arbitrary code.

The vulnerability of the Cacti network monitoring software exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Vulnerabilities fixed in Cacti

The developers of Cacti have fixed several vulnerabilities in Cacti. A malicious party can exploit the vulnerabilities to execute attacks that can result in the following categories of damage: SQL Injection Cross-Site Scripting XSS Remote code execution User rights Remote code execution...

The vulnerability in the templatesimport.php script of the Cacti network monitoring tool allows a hacker to perform cross-site scripting attacks and gain unauthorized access to read, modify, or delete data.

The vulnerability of the templatesimport.php script, a monitoring tool for network management in Cacti, is related to insufficient protection of the website structure. Exploiting this vulnerability allows an attacker to perform cross-site scripting attacks and gain unauthorized access to read,...

The vulnerability of the SNMP Notification Receiver function in the managers.php script of the Cacti network monitoring software allows a hacker to execute arbitrary SQL code.

The vulnerability of the SNMP Notification Receiver function in the managers.php script of the Cacti network monitoring software is related to the lack of security measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL code by sending...

Cross-Site Scripting

cacti is vulnerable to Cross-Site Scripting. The vulnerability is due to in templatesimport.php When uploading an xml template file, if the XML file does not pass the check, the server will give a JavaScript pop-up prompt, which contains unfiltered xml template file name, potentially leads to XSS...

Cross Site Scripting (XSS)

Cacti is vulnerable to Cross Site Scripting XSS. The vulnerability is due to missing XML file name sanitization during template upload. If the template fails the checks, the raw filename is displayed as a JavaScript pop-up prompt. An attacker can upload a XML filename including a JavaScript...

SQL Injection And Path Traversal

Cacti is vulnerable to SQL Injection and Path Traversal. The vulnerability is caused due to improper input sanitization within link.php component. This allows an authorized user to execute arbitrary code on the server...

SQL Injection

Cacti is vulnerable to SQL Injection. The vulnerability is due to a lack of input sanitization in pollers.php script. This allows an attacker to potentially execute malicious SQL code, resulting in a SQL injection...

Cross-site Scripting (XSS)

cacti, sid is vulnerable of cross site scriptingxss. The vulnerability due to victim browser execute malicious code when their mouse over the malicious data source path in datadebug.php. It allows an authenticated user to poison data stored in the cacti's database and finally it leads to cross si...

SQL Injection

Cacti is vulnerable to SQL Injection vulnerability. The vulnerability is due to improper sanitization and validation via the formactions function in the managers.php function. This issue can be exploited by an attacker to obtain sensitive information via SQL Injection...

SUSE CVE-2023-49085

Cacti provides an operational monitoring and fault management framework. In versions 1.2.25 and prior, it is possible to execute arbitrary SQL code through the pollers.php script. An authorized user may be able to execute arbitrary SQL code. The vulnerable component is the pollers.php. Impact of...

SUSE CVE-2023-49088

Cacti is an open source operational monitoring and fault management framework. The fix applied for CVE-2023-39515 in version 1.2.25 is incomplete as it enables an adversary to have a victim browser execute malicious code when a victim user hovers their mouse over the malicious data source path in...

SUSE CVE-2023-50250

Cacti is an open source operational monitoring and fault management framework. A reflection cross-site scripting vulnerability was discovered in version 1.2.25. Attackers can exploit this vulnerability to perform actions on behalf of other users. The vulnerability is found in templatesimport.php...

Cacti cross-site scripting vulnerability (CNVD-2023-10109007)

Cacti is a set of open source network traffic monitoring and analysis tools from the Cacti team. The tool through snmpget to get the data , using RRDtool drawing graphs to analyze , and provide data and user management features . Cacti versions prior to 1.2.26 cross-site scripting vulnerability ,...

PT-2023-8526 · Cacti +1 · Cacti +1

Name of the Vulnerable Software and Affected Versions: Cacti versions affected versions not specified VR-S1000 firmware versions prior to 2.42 Description: The issue is related to a lack of protection in the SQL query structure in Cacti, and in VR-S1000 firmware, it allows an attacker with access...

SUSE CVE-2023-49084

Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database TSDB. While using the detected SQL Injection and insufficient processing of the include file path, it is possible to execute arbitrary code on the server. Exploitation of the...

SUSE CVE-2023-49086

Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database TSDB. A vulnerability in versions prior to 1.2.27 bypasses an earlier fix for CVE-2023-39360, therefore leading to a DOM XSS attack. Exploitation of the vulnerability is possible for an...

CVE-2023-50250

Cacti is an open source operational monitoring and fault management framework. A reflection cross-site scripting vulnerability was discovered in version 1.2.25. Attackers can exploit this vulnerability to perform actions on behalf of other users. The vulnerability is found in templatesimport.php...

CVE-2023-51448

Cacti provides an operational monitoring and fault management framework. Version 1.2.25 has a Blind SQL Injection SQLi vulnerability within the SNMP Notification Receivers feature in the file ‘managers.php’. An authenticated attacker with the “Settings/Utilities” permission can send a crafted HTT...

DEBIAN-CVE-2023-50250

Cacti is an open source operational monitoring and fault management framework. A reflection cross-site scripting vulnerability was discovered in version 1.2.25. Attackers can exploit this vulnerability to perform actions on behalf of other users. The vulnerability is found in templatesimport.php...