The vulnerability of the form_save() function (data_queries.php) in the Cacti network monitoring software allows a hacker to execute cross-site scripting attacks.

The vulnerability of the formsave function in the Cacti monitoring software’s dataqueries.php file is related to the lack of protective measures for the website structure. Exploiting this vulnerability could allow a malicious actor to carry out XSS attacks...

CVE-2024-31458: Improper Neutralization of Special Elements used in an SQL Command

Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in formsave function in graphtemplateinputs.php is not thoroughly checked and is used to concatenate the SQL statement in drawnontemplatedfieldsgraphitem function from...

CVE-2024-31443: Improper Neutralization of Input During Web Page Generation

Cacti provides an operational monitoring and fault management framework. Prior to 1.2.27, some of the data stored in formsave function in dataqueries.php is not thoroughly checked and is used to concatenate the HTML statement in growrightpanetree function from lib/html.php , finally resulting in...