CVE-2006-6799
SQL injection vulnerability in Cacti 0.8.6i and earlier, when register_argc_argv is enabled,...
SQL injection vulnerability in Cacti 0.8.6i and earlier, when register_argc_argv is enabled, allows remote attackers to execute arbitrary SQL commands via the (1) second or (2) third arguments to cmd.php. NOTE: this issue can be leveraged to execute arbitrary commands since the SQL query results are later used in the polling_items array and popen function.
Exploit likelihood
What each source reports
NVD Score used
SQL injection vulnerability in Cacti 0.8.6i and earlier, when register_argc_argv is enabled, allows remote attackers to execute arbitrary SQL commands via the (1) second or (2) third arguments to cmd.php. NOTE: this issue can be leveraged to execute arbitrary commands since the SQL query results are later used in the polling_items array and popen function.
- Record
CVE-2006-6799- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
SQL injection vulnerability in Cacti 0.8.6i and earlier, when register_argc_argv is enabled, allows remote attackers to execute arbitrary SQL commands via the (1) second or (2) third arguments to cmd.php. NOTE: this issue can be leveraged to execute arbitrary commands since the SQL query results are later used in the polling_items array and popen function.
- Record
CVE-2006-6799- Updated
- 2026-11-02
EUVDEUVD-2006-6782 No score
SQL injection vulnerability in Cacti 0.8.6i and earlier, when register_argc_argv is enabled, allows remote attackers to execute arbitrary SQL commands via the (1) second or (2) third arguments to cmd.php. NOTE: this issue can be leveraged to execute arbitrary commands since the SQL query results are later used in the polling_items array and popen function.
- Record
EUVD-2006-6782- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8f93-437m-m53h No score
SQL injection vulnerability in Cacti 0.8.6i and earlier, when register_argc_argv is enabled,...
SQL injection vulnerability in Cacti 0.8.6i and earlier, when register_argc_argv is enabled, allows remote attackers to execute arbitrary SQL commands via the (1) second or (2) third arguments to cmd.php. NOTE: this issue can be leveraged to execute arbitrary commands since the SQL query results are later used in the polling_items array and popen function.
- Record
GHSA-8f93-437m-m53h- Updated
- 2026-11-02
OSV No score
SQL injection vulnerability in Cacti 0.8.6i and earlier, when register_argc_argv is enabled, allows remote attackers to execute arbitrary SQL commands via the (1) second or (2) third arguments to cmd.php. NOTE: this issue can be leveraged to execute arbitrary commands since the SQL query results are later used in the polling_items array and popen function.
- Record
CVE-2006-6799- Updated
- 2026-11-02
OSVDEBIAN-CVE-2006-6799 No score
SQL injection vulnerability in Cacti 0.8.6i and earlier, when register_argc_argv is enabled, allows remote attackers to execute arbitrary SQL commands via the (1) second or (2) third arguments to cmd.php. NOTE: this issue can be leveraged to execute arbitrary commands since the SQL query results are later used in the polling_items array and popen function.
- Record
DEBIAN-CVE-2006-6799- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10670-1 No score
cacti-1.2.18-1.2 on GA media
These are all security issues fixed in the cacti-1.2.18-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10670-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cactiDebian:12 |
before 0.8.6i-3 | 0.8.6i-3 |
cactiDebian:13 |
before 0.8.6i-3 | 0.8.6i-3 |
cactiDebian:14 |
before 0.8.6i-3 | 0.8.6i-3 |
cactiDebian:3.1 |
before 0.8.6c-7sarge4, plus listed versions 0.8.6c-70.8.6c-7sarge20.8.6c-7sarge3 |
0.8.6c-7sarge4 |
cactiopenSUSE:Tumbleweed From an advisory covering 31 CVEs |
before 1.2.18-1.2 | 1.2.18-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-6799 is a high vulnerability (CVSS 7.5) in The Cacti Group Cacti, published December 28, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.59%, the 85th percentile. Fixed in cacti 0.8.6i-3.
References
debian.org/security/2007/dsa-1250
openpkg.com/security/advisories/OpenPKG-SA-2007.001.html
secunia.com/advisories/23917
mandriva.com/security/advisories?name=MDKSA-2007:015
securitytracker.com/id?1017451
Show 44 moreShow less
exchange.xforce.ibmcloud.com/vulnerabilities/31177
security.gentoo.org/glsa/glsa-200701-23.xml
novell.com/linux/security/advisories/2007_07_cacti.html
vupen.com/english/advisories/2006/5193
cacti.net/release_notes_0_8_6j.php
exploit-db.com/exploits/3029
securityfocus.com/bid/21799
nvd.nist.gov/vuln/detail/CVE-2006-6799
github.com/advisories/GHSA-8f93-437m-m53h
security-tracker.debian.org/tracker/CVE-2006-6799
suse.com/security/cve/CVE-2006-6799