CVE-2008-0785

Multiple SQL injection vulnerabilities in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allow...

7.5 HighPublic exploitFix available

Multiple SQL injection vulnerabilities in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allow remote authenticated users to execute arbitrary SQL commands via the (1) graph_list parameter to graph_view.php, (2) leaf_id and id parameters to tree.php, (3) local_graph_id parameter to graph_xport.php, and (4) login_username parameter to index.php/login.

Exploit likelihood

3.44%Down 1.0 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Record: CVE-2008-0785
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-89
Updated: 2026-11-02

CVE List No score

Record: CVE-2008-0785
Updated: 2026-11-02

EUVDEUVD-2008-0792 No score

Record: EUVD-2008-0792
Updated: 2026-11-03

GitHub AdvisoriesGHSA-5mjg-w552-cfpq No score

Multiple SQL injection vulnerabilities in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allow...

Record: GHSA-5mjg-w552-cfpq
Weakness: CWE-89
Updated: 2026-11-02

OSV No score

Record: CVE-2008-0785
Updated: 2026-11-02

OSVDEBIAN-CVE-2008-0785 No score

Record: DEBIAN-CVE-2008-0785
Updated: 2026-11-02

Affected products

cacti

Affected packages

Affected packages
Package	Affected	Fixed
`cacti` Debian:12	before 0.8.7b-1	0.8.7b-1
`cacti` Debian:13	before 0.8.7b-1	0.8.7b-1
`cacti` Debian:14	before 0.8.7b-1	0.8.7b-1
`cacti` Debian:4.0 From an advisory covering 2 CVEs	before 0.8.6i-3.3, plus listed versions 0.8.6i-30.8.6i-3.2	0.8.6i-3.3

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Cacti 0.8.7 - 'graph_view.php?graph_list' SQL Injection	2008-02-12
Exploit-DB	Cacti 0.8.7 - 'tree.php' Multiple SQL Injections	2008-02-12
Exploit-DB	Cacti 0.8.7 - 'graph_xport.php?local_graph_id' SQL Injection	2008-02-12
Exploit-DB	Cacti 0.8.7 - '/index.php/sql.php?Login Action login_username' SQL Injection	2008-02-12

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2008-0785 is a high vulnerability (CVSS 7.5) in Cacti, published February 14, 2008. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.44%, the 89th percentile. Fixed in cacti 0.8.7b-1.

References

Show 16 moreShow less