CVE-2023-39358

Cacti is an open source operational monitoring and fault management framework. An authenticated SQL injection vulnerability was discovered which allows authenticated users to perform privilege escalation and remote code execution. The vulnerability resides in the reportsuser.php file. In...

CVE-2023-39359

CVE-2023-39359 affects the Cacti monitoring framework. An authenticated SQL injection exists in the graphs.php handler (ajax_hosts / ajax_hosts_noany) where a non-zero site_id is reflected in the WHERE clause, enabling privilege escalation and remote code execution per the cited description. The ...

CVE-2023-39359 Authenticated SQL injection vulnerability in graphs.php in Cacti

Cacti is an open source operational monitoring and fault management framework. An authenticated SQL injection vulnerability was discovered which allows authenticated users to perform privilege escalation and remote code execution. The vulnerability resides in the graphs.php file. When dealing wit...

CVE-2023-39361 Unauthenticated SQL Injection in graph_view.php in Cacti

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a SQL injection discovered in graphview.php. Since guest users can access graphview.php without authentication by default, if guest users are being utilized in an enabled state, there...

CVE-2023-39361

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a SQL injection discovered in graphview.php. Since guest users can access graphview.php without authentication by default, if guest users are being utilized in an enabled state, there...

CVE-2023-39361

CVE-2023-39361 affects Cacti (notably 1.2.24) via a SQL injection in graph_view.php. The vulnerability arises when guest users can access graph_view.php without authentication, enabling an attacker to inject SQL through the rfilter parameter (within the grow_right_pane_tree path) and potentially ...

CVE-2023-39360

CVE-2023-39360 is a stored XSS in Cacti’s graphs_new.php. An authenticated user can poison stored data via the returnto parameter passed to form_save_button; bypass occurs when returnto contains host.php. The issue affects Cacti prior to the fixed release and can impact data integrity and user se...

CVE-2023-39360 Reflected Cross-site Scripting in graphs_new.php in Cacti

Cacti is an open source operational monitoring and fault management framework.Affected versions are subject to a Stored Cross-Site-Scripting XSS Vulnerability allows an authenticated user to poison data. The vulnerability is found in graphsnew.php. Several validations are performed, but the...

CVE-2023-39360

Cacti is an open source operational monitoring and fault management framework.Affected versions are subject to a Stored Cross-Site-Scripting XSS Vulnerability allows an authenticated user to poison data. The vulnerability is found in graphsnew.php. Several validations are performed, but the...

CVE-2023-39360

Cacti is an open source operational monitoring and fault management framework.Affected versions are subject to a Stored Cross-Site-Scripting XSS Vulnerability allows an authenticated user to poison data. The vulnerability is found in graphsnew.php. Several validations are performed, but the...

CVE-2023-39366

CVE-2023-39366 affects Cacti (web-based monitoring) with a stored XSS in the data_sources view caused by malicious device-name configuration via host.php; the payload can execute in admin users’ browsers when viewing data sources. Affected versions are mitigated by upgrading to Cacti 1.2.25. If u...

CVE-2023-39510

CVE-2023-39510 affects Cacti prior to 1.2.25, enabling a stored XSS via malicious device names configured in host.php and rendered in reports_admin.php, viewable by admins with High privileges. The vulnerability relies on insufficient output filtering so that an authenticated user can poison data...

CVE-2023-39510 Stored Cross-site Scripting in reports_admin.php through Device-Name in 'select' input in Cacti

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting XSS Vulnerability allows an authenticated user to poison data stored in the cacti's database. These data will be viewed by administrative cacti accounts an...

CVE-2023-39510 Stored Cross-site Scripting in reports_admin.php through Device-Name in 'select' input in Cacti

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting XSS Vulnerability allows an authenticated user to poison data stored in the cacti's database. These data will be viewed by administrative cacti accounts an...

CVE-2023-39512

CVE-2023-39512 affects Cacti web monitoring software. A stored XSS exists in the data_sources.php output when an authenticated user configures a malicious device name via host.php, allowing injected JavaScript to execute in admin views at view-time. The vulnerability relies on data poisoned by th...

CVE-2023-39512 Stored Cross-site Scripting on data_sources.php device name view in Cacti

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting XSS Vulnerability which allows an authenticated user to poison data stored in the cacti's database. These data will be viewed by administrative cacti...

CVE-2023-39513

CVE-2023-39513 affects Cacti (web-based network monitoring). A stored XSS exists via the data_queries template path; an authenticated user with Data Queries/Template Editor rights can inject code that is rendered in the host/php view, potentially executing JavaScript in admin contexts. The vulner...

CVE-2023-39515

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting XSS Vulnerability allows an authenticated user to poison data stored in the cacti's database. These data will be viewed by administrative cacti accounts an...

CVE-2023-39515

Cacti Stored XSS (CVE-2023-39515) affects data_debug.php and is exploitable by authenticated users with General Administration>Sites/Devices/Data, enabling JavaScript in admin-viewed data. Affected via malicious data-source path configuration; fix: upgrade to 1.2.25. Note: CVE-2023-49088 indic...

CVE-2023-39515 Stored Cross-site Scripting on data_debug.php datasource path view in Cacti

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting XSS Vulnerability allows an authenticated user to poison data stored in the cacti's database. These data will be viewed by administrative cacti accounts an...