Cacti Security Vulnerabilities and Issues — Cacti CVE List

Lucene search

CactiCacti

4 matches found

CVE•added 2023/08/22 7:16 p.m.•60 views

CVE-2022-41444

Cross Site Scripting (XSS) vulnerability in Cacti 1.2.21 via crafted POST request to graphs_new.php.

6.1CVSS5.9AI score0.00673EPSS

CVE•added 2023/08/22 7:16 p.m.•56 views

CVE-2022-48538

In Cacti 1.2.19, there is an authentication bypass in the web login functionality because of improper validation in the PHP code: cacti_ldap_auth() allows a zero as the password.

5.3CVSS5.8AI score0.00099EPSS

CVE•added 2023/08/10 3:15 p.m.•47 views

CVE-2023-37543

Cacti before 1.2.6 allows IDOR (Insecure Direct Object Reference) for accessing any graph via a modified local_graph_id parameter to graph_xport.php. This is a different vulnerability than CVE-2019-16723.

7.5CVSS5.6AI score0.00473EPSS

CVE•added 2023/08/22 7:16 p.m.•38 views

CVE-2022-48547

A reflected cross-site scripting (XSS) vulnerability in Cacti 0.8.7g and earlier allows unauthenticated remote attackers to inject arbitrary web script or HTML in the "ref" parameter at auth_changepassword.php.

6.1CVSS6AI score0.00516EPSS