Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Perimeter Scanner
Scanning
Projects
Scanner
Agent Scanning
API Scanning
Manual Audit
Email
Webhook
Resources
Documents
Blog
Glossary
FAQ
Plugins
Pricing
Contacts
About Us
Partners
Branding Guideline
Settings
Sign in
CactiCacti

33 matches found

CVE
CVE•added 2020/01/16 4:15 a.m.•243 views

CVE-2020-7106

Cacti 1.2.8 has stored XSS in data_sources.php, color_templates_item.php, graphs.php, graph_items.php, lib/api_automation.php, user_admin.php, and user_group_admin.php, as demonstrated by the description parameter in data_sources.php (a raw string from the database that is displayed by $header to t...

6.1CVSS6.7AI score0.04094EPSS
CVE
CVE•added 2020/01/21 7:15 p.m.•164 views

CVE-2019-17357

Cacti through 1.2.7 is affected by a graphs.php?template_id= SQL injection vulnerability affecting how template identifiers are handled when a string and id composite value are used to identify the template type and id. An authenticated attacker can exploit this to extract data from the database, o...

6.5CVSS7.5AI score0.06768EPSS
CVE
CVE•added 2023/09/05 10:15 p.m.•160 views

CVE-2023-39516

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the cacti 's database. These data will be viewed by administrative cacti acco...

6.1CVSS6.6AI score0.00259EPSS
CVE
CVE•added 2023/09/05 9:15 p.m.•146 views

CVE-2023-39515

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data stored in the cacti's database. These data will be viewed by administrative cacti accounts an...

6.1CVSS6.1AI score0.00235EPSS
CVE
CVE•added 2023/09/05 10:15 p.m.•145 views

CVE-2023-39365

Cacti is an open source operational monitoring and fault management framework. Issues with Cacti Regular Expression validation combined with the external links feature can lead to limited SQL Injections and subsequent data leakage. This issue has been addressed in version 1.2.25. Users are advised ...

6.3CVSS7.1AI score0.0017EPSS
CVE
CVE•added 2023/09/05 9:15 p.m.•139 views

CVE-2023-39360

Cacti is an open source operational monitoring and fault management framework.Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data. The vulnerability is found in graphs_new.php. Several validations are performed, but the retu...

6.1CVSS6.4AI score0.00482EPSS
CVE
CVE•added 2023/09/05 9:15 p.m.•121 views

CVE-2023-39366

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data stored in the cacti 's database. These data will be viewed by administrative cacti accounts a...

6.1CVSS5.7AI score0.00331EPSS
CVE
CVE•added 2023/09/06 6:15 p.m.•111 views

CVE-2023-39511

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the cacti 's database. These data will be viewed by administrative cacti acco...

6.1CVSS6.5AI score0.00512EPSS
CVE
CVE•added 2020/11/12 2:15 p.m.•83 views

CVE-2020-25706

A cross-site scripting (XSS) vulnerability exists in templates_import.php (Cacti 1.2.13) due to Improper escaping of error message during template import preview in the xml_path field

6.1CVSS5.8AI score0.01974EPSS
CVE
CVE•added 2021/08/27 6:15 p.m.•76 views

CVE-2020-23226

Multiple Cross Site Scripting (XSS) vulneratiblities exist in Cacti 1.2.12 in (1) reports_admin.php, (2) data_queries.php, (3) data_input.php, (4) graph_templates.php, (5) graphs.php, (6) reports_admin.php, and (7) data_input.php.

6.1CVSS6AI score0.0129EPSS
CVE
CVE•added 2023/12/22 5:15 p.m.•72 views

CVE-2023-49088

Cacti is an open source operational monitoring and fault management framework. The fix applied for CVE-2023-39515 in version 1.2.25 is incomplete as it enables an adversary to have a victim browser execute malicious code when a victim user hovers their mouse over the malicious data source path in d...

6.1CVSS6.6AI score0.00982EPSS
CVE
CVE•added 2014/04/23 3:55 p.m.•71 views

CVE-2014-2328

lib/graph_export.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote authenticated users to execute arbitrary commands via shell metacharacters in unspecified vectors.

6.5CVSS8.6AI score0.01128EPSS
CVE
CVE•added 2015/12/15 9:59 p.m.•71 views

CVE-2015-8377

SQL injection vulnerability in the host_new_graphs_save function in graphs_new.php in Cacti 0.8.8f and earlier allows remote authenticated users to execute arbitrary SQL commands via crafted serialized data in the selected_graphs_array parameter in a save action.

6.5CVSS8.7AI score0.00327EPSS
CVE
CVE•added 2021/11/14 8:15 p.m.•70 views

CVE-2020-14424

Cacti before 1.2.18 allows remote attackers to trigger XSS via template import for the midwinter theme.

6.1CVSS6AI score0.00386EPSS
CVE
CVE•added 2014/04/23 3:55 p.m.•60 views

CVE-2014-2327

Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that (1) modify binary files, (2) modify configurations, or (3) add arbitrary users.

6.8CVSS8.8AI score0.00424EPSS
CVE
CVE•added 2023/08/22 7:16 p.m.•58 views

CVE-2022-41444

Cross Site Scripting (XSS) vulnerability in Cacti 1.2.21 via crafted POST request to graphs_new.php.

6.1CVSS5.9AI score0.00673EPSS
CVE
CVE•added 2023/10/27 10:15 p.m.•58 views

CVE-2023-46490

SQL Injection vulnerability in Cacti v1.2.25 allows a remote attacker to obtain sensitive information via the form_actions() function in the managers.php function.

6.5CVSS6.6AI score0.00207EPSS
CVE
CVE•added 2010/08/23 10:0 p.m.•57 views

CVE-2010-1645

Cacti before 0.8.7f, as used in Red Hat High Performance Computing (HPC) Solution and other products, allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in (1) the FQDN field of a Device or (2) the Vertical Label field of a Graph Template.

6.5CVSS7.2AI score0.01961EPSS
CVE
CVE•added 2020/05/20 2:15 p.m.•57 views

CVE-2020-13231

In Cacti before 1.2.11, auth_profile.php?action=edit allows CSRF for an admin email change.

6.5CVSS6.5AI score0.00456EPSS
CVE
CVE•added 2022/01/19 9:15 p.m.•55 views

CVE-2021-26247

As an unauthenticated remote user, visit "http:///auth_changepassword.php?ref=" to successfully execute the JavaScript payload present in the "ref" URL parameter.

6.1CVSS6.4AI score0.28433EPSS
CVE
CVE•added 2023/09/05 9:15 p.m.•54 views

CVE-2023-39514

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the cacti 's database. These data will be viewed by administrative cacti acco...

6.1CVSS6.8AI score0.00292EPSS
CVE
CVE•added 2023/09/05 9:15 p.m.•53 views

CVE-2023-39512

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the cacti 's database. These data will be viewed by administrative cacti acco...

6.1CVSS5.7AI score0.0045EPSS
CVE
CVE•added 2017/08/18 2:29 a.m.•49 views

CVE-2017-12927

A cross-site scripting vulnerability exists in Cacti 1.1.17 in the method parameter in spikekill.php.

6.1CVSS5.7AI score0.00519EPSS
CVE
CVE•added 2023/09/05 9:15 p.m.•49 views

CVE-2023-39513

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the cacti 's database. These data will be viewed by administrative cacti acco...

6.1CVSS6.6AI score0.00418EPSS
CVE
CVE•added 2025/01/27 4:15 p.m.•48 views

CVE-2024-45598

Cacti is an open source performance and fault management framework. Prior to 1.2.29, an administrator can change the Poller Standard Error Log Path parameter in either Installation Step 5 or in Configuration->Settings->Paths tab to a local file inside the server. Then simply going to Logs tab...

6CVSS6.5AI score0.00094EPSS
CVE
CVE•added 2017/07/17 1:18 p.m.•47 views

CVE-2017-1000032

Cross-Site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote attackers to inject arbitrary web script or HTML via the parent_id parameter to tree.php and drp_action parameter to data_sources.php.

6.1CVSS6.6AI score0.00196EPSS
CVE
CVE•added 2017/10/11 1:32 a.m.•46 views

CVE-2017-15194

include/global_session.php in Cacti 1.1.25 has XSS related to (1) the URI or (2) the refresh page.

6.1CVSS5.7AI score0.00312EPSS
CVE
CVE•added 2023/09/05 9:15 p.m.•46 views

CVE-2023-39510

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data stored in the cacti 's database. These data will be viewed by administrative cacti accounts a...

6.1CVSS5.7AI score0.0045EPSS
CVE
CVE•added 2023/12/22 5:15 p.m.•46 views

CVE-2023-50250

Cacti is an open source operational monitoring and fault management framework. A reflection cross-site scripting vulnerability was discovered in version 1.2.25. Attackers can exploit this vulnerability to perform actions on behalf of other users. The vulnerability is found in templates_import.php. ...

6.1CVSS5.3AI score0.02167EPSS
CVE
CVE•added 2017/11/10 11:29 p.m.•44 views

CVE-2017-16785

Cacti 1.1.27 has reflected XSS via the PATH_INFO to host.php.

6.1CVSS6AI score0.00196EPSS
CVE
CVE•added 2015/05/22 12:59 a.m.•43 views

CVE-2015-0916

SQL injection vulnerability in graph.php in Cacti before 0.8.6f allows remote authenticated users to execute arbitrary SQL commands via the local_graph_id parameter, a different vulnerability than CVE-2007-6035.

6.5CVSS7.8AI score0.04252EPSS
CVE
CVE•added 2024/05/14 3:22 p.m.•43 views

CVE-2024-30268

Cacti provides an operational monitoring and fault management framework. A reflected cross-site scripting vulnerability on the 1.3.x DEV branch allows attackers to obtain cookies of administrator and other users and fake their login using obtained cookies. This issue is fixed in commit a38b9046e977...

6.1CVSS5.8AI score0.00123EPSS
CVE
CVE•added 2023/08/22 7:16 p.m.•36 views

CVE-2022-48547

A reflected cross-site scripting (XSS) vulnerability in Cacti 0.8.7g and earlier allows unauthenticated remote attackers to inject arbitrary web script or HTML in the "ref" parameter at auth_changepassword.php.

6.1CVSS6AI score0.00516EPSS