CVE-2014-5262
SQL injection vulnerability in the graph settings script (graph_settings.php) in Cacti 0.8.8b and...
SQL injection vulnerability in the graph settings script (graph_settings.php) in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Exploit likelihood
What each source reports
NVD Score used
SQL injection vulnerability in the graph settings script (graph_settings.php) in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Record
CVE-2014-5262- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-89
- Updated
- 2026-11-02
CVE List No score
SQL injection vulnerability in the graph settings script (graph_settings.php) in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Record
CVE-2014-5262- Updated
- 2026-11-02
EUVDEUVD-2014-5155 No score
SQL injection vulnerability in the graph settings script (graph_settings.php) in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Record
EUVD-2014-5155- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h375-wfx8-8qcx No score
SQL injection vulnerability in the graph settings script (graph_settings.php) in Cacti 0.8.8b and...
SQL injection vulnerability in the graph settings script (graph_settings.php) in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Record
GHSA-h375-wfx8-8qcx- Weakness
- CWE-89
- Updated
- 2026-11-02
OSV No score
SQL injection vulnerability in the graph settings script (graph_settings.php) in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Record
CVE-2014-5262- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-5262 No score
SQL injection vulnerability in the graph settings script (graph_settings.php) in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Record
DEBIAN-CVE-2014-5262- Updated
- 2026-11-02
OSVMGASA-2014-0403 No score
Updated cacti package fixes multiple security vulnerabilities
Updated cacti package fixes security vulnerabilities:
Multiple security issues (cross-site scripting, missing input sanitising and SQL injection) have been discovered in Cacti, a web interface for graphing of monitoring systems (CVE-2014-5025, CVE-2014-5026, CVE-2014-5261, CVE-2014-5262).
- Record
MGASA-2014-0403- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-5262 No score
SQL injection vulnerability in the graph settings script (graph_settings.php) in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Record
UBUNTU-CVE-2014-5262- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cactiDebian:12 |
before 0.8.8b+dfsg-8 | 0.8.8b+dfsg-8 |
cactiDebian:13 |
before 0.8.8b+dfsg-8 | 0.8.8b+dfsg-8 |
cactiDebian:14 |
before 0.8.8b+dfsg-8 | 0.8.8b+dfsg-8 |
cactiDebian:6.0 |
before 0.8.7g-1+squeeze5, plus listed versions 0.8.7g-10.8.7g-1+squeeze10.8.7g-1+squeeze20.8.7g-1+squeeze30.8.7g-1+squeeze4 |
0.8.7g-1+squeeze5 |
cactiDebian:7 |
before 0.8.8a+dfsg-5+deb7u4, plus listed versions 0.8.8a+dfsg-50.8.8a+dfsg-5+deb7u10.8.8a+dfsg-5+deb7u20.8.8a+dfsg-5+deb7u3 |
0.8.8a+dfsg-5+deb7u4 |
cactiMageia:4 |
before 0.8.8b-3.2.mga4 | 0.8.8b-3.2.mga4 |
cactiUbuntu:14.04:LTS |
before 0.8.8b+dfsg-5ubuntu0.1, plus listed versions 0.8.8b+dfsg-30.8.8b+dfsg-5 |
0.8.8b+dfsg-5ubuntu0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-5262 is a high vulnerability (CVSS 7.5) in Cacti, published August 20, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.27%, the 83rd percentile. Fixed in cacti 0.8.8b+dfsg-8.
References
security.gentoo.org/glsa/201607-05
debian.org/security/2014/dsa-3007
bugzilla.redhat.com/show_bug.cgi?id=1127165
seclists.org/oss-sec/2014/q3/351
exchange.xforce.ibmcloud.com/vulnerabilities/95292
svn.cacti.net/viewvc?view=rev&revision=7454
Show 9 moreShow less
securityfocus.com/bid/69213
nvd.nist.gov/vuln/detail/CVE-2014-5262
github.com/advisories/GHSA-h375-wfx8-8qcx
security-tracker.debian.org/tracker/CVE-2014-5262
advisories.mageia.org/MGASA-2014-0403.html
bugs.mageia.org/show_bug.cgi?id=13930
ubuntu.com/security/CVE-2014-5262
cve.org/CVERecord?id=CVE-2014-5262