Cacti - Cross-Site Scripting

Cacti contains a cross-site scripting vulnerability via "http:///authchangepassword.php?ref=alert1" which can successfully execute the JavaScript payload present in the "ref" URL parameter. id: CVE-2021-26247 info: name: Cacti - Cross-Site Scripting author: dhiyaneshDK severity: medium descriptio...

CVE-2021-26247

As an unauthenticated remote user, visit "http:///authchangepassword.php?ref=" to successfully execute the JavaScript payload present in the "ref" URL parameter...

CVE-2021-26247

As an unauthenticated remote user, visit "http:///authchangepassword.php?ref=alert1" to successfully execute the JavaScript payload present in the "ref" URL parameter...

DEBIAN-CVE-2021-26247

As an unauthenticated remote user, visit "http:///authchangepassword.php?ref=alert1" to successfully execute the JavaScript payload present in the "ref" URL parameter...

CVE-2021-26247

As an unauthenticated remote user, visit "http:///authchangepassword.php?ref=alert1" to successfully execute the JavaScript payload present in the "ref" URL parameter...

CVE-2021-26247

CVE-2021-26247 affects Cacti. The vulnerability is a stored/reflected cross-site scripting in the auth_changepassword.php endpoint, where an unauthenticated remote user can supply a ref parameter containing a script tag to execute JavaScript in a victim’s browser. Impact described includes arbitr...