Every CVE Search/ Get API key

CVE-2016-3172

SQL injection vulnerability in tree.php in Cacti 0.8.8g and earlier allows remote authenticated...

8.8 HighFix available

SQL injection vulnerability in tree.php in Cacti 0.8.8g and earlier allows remote authenticated users to execute arbitrary SQL commands via the parent_id parameter in an item_edit action.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

2.83%Up 1.6 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 8.8

SQL injection vulnerability in tree.php in Cacti 0.8.8g and earlier allows remote authenticated users to execute arbitrary SQL commands via the parent_id parameter in an item_edit action.

Record
CVE-2016-3172
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
6.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:P
Weakness
CWE-89
Updated
2026-11-02
CVE List No score

SQL injection vulnerability in tree.php in Cacti 0.8.8g and earlier allows remote authenticated users to execute arbitrary SQL commands via the parent_id parameter in an item_edit action.

Record
CVE-2016-3172
Updated
2026-11-02
EUVDEUVD-2016-4214 No score

SQL injection vulnerability in tree.php in Cacti 0.8.8g and earlier allows remote authenticated users to execute arbitrary SQL commands via the parent_id parameter in an item_edit action.

Record
EUVD-2016-4214
Updated
2026-11-03
GitHub AdvisoriesGHSA-3pph-g5w6-c57w 8.8

SQL injection vulnerability in tree.php in Cacti 0.8.8g and earlier allows remote authenticated...

SQL injection vulnerability in tree.php in Cacti 0.8.8g and earlier allows remote authenticated users to execute arbitrary SQL commands via the parent_id parameter in an item_edit action.

Record
GHSA-3pph-g5w6-c57w
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-89
Updated
2026-11-02
OSVALPINE-CVE-2016-3172 8.8

SQL injection vulnerability in tree.php in Cacti 0.8.8g and earlier allows remote authenticated users to execute arbitrary SQL commands via the parent_id parameter in an item_edit action.

Record
ALPINE-CVE-2016-3172
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 8.8

SQL injection vulnerability in tree.php in Cacti 0.8.8g and earlier allows remote authenticated users to execute arbitrary SQL commands via the parent_id parameter in an item_edit action.

Record
CVE-2016-3172
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2016-3172 8.8

SQL injection vulnerability in tree.php in Cacti 0.8.8g and earlier allows remote authenticated users to execute arbitrary SQL commands via the parent_id parameter in an item_edit action.

Record
DEBIAN-CVE-2016-3172
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2016-3172 8.8

SQL injection vulnerability in tree.php in Cacti 0.8.8g and earlier allows remote authenticated users to execute arbitrary SQL commands via the parent_id parameter in an item_edit action.

Record
UBUNTU-CVE-2016-3172
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2016-0178 No score

Updated cacti packages fix security vulnerabilities

Updated cacti package fixes security vulnerability:

SQL injection vulnerability in tree.php in Cacti 0.8.8g and earlier allows remote authenticated users to execute arbitrary SQL commands via the parent_id parameter in an item_edit action (CVE-2016-3172).

SQL injection vulnerability in graph_view.php in Cacti 0.8.8.g and earlier allows remote authenticated users to execute arbitrary SQL commands via the host_group_data parameter (CVE-2016-3659).

Record
MGASA-2016-0178
Updated
2026-11-02
OSVopenSUSE-SU-2024:10084-1 No score

cacti-0.8.8h-1.2 on GA media

These are all security issues fixed in the cacti-0.8.8h-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10084-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
cacti
Alpine:v3.2
 before 0.8.8g-r1
0.8.8g-r1
cacti
Alpine:v3.3
 before 0.8.8g-r1
0.8.8g-r1
cacti
Debian:12
 before 0.8.8g+ds1-2
0.8.8g+ds1-2
cacti
Debian:13
 before 0.8.8g+ds1-2
0.8.8g+ds1-2
cacti
Debian:14
 before 0.8.8g+ds1-2
0.8.8g+ds1-2
cacti
Debian:7
From an advisory covering 3 CVEs
 before 0.8.8a+dfsg-5+deb7u9, plus listed versions
0.8.8a+dfsg-50.8.8a+dfsg-5+deb7u10.8.8a+dfsg-5+deb7u20.8.8a+dfsg-5+deb7u30.8.8a+dfsg-5+deb7u4
Show 4 moreShow less
0.8.8a+dfsg-5+deb7u50.8.8a+dfsg-5+deb7u60.8.8a+dfsg-5+deb7u70.8.8a+dfsg-5+deb7u8
0.8.8a+dfsg-5+deb7u9
cacti
Mageia:5
From an advisory covering 2 CVEs
 before 0.8.8f-1.5.mga5
0.8.8f-1.5.mga5
cacti
Ubuntu:14.04:LTS
 before 0.8.8b+dfsg-5ubuntu0.2, plus listed versions
0.8.8b+dfsg-30.8.8b+dfsg-50.8.8b+dfsg-5ubuntu0.1
0.8.8b+dfsg-5ubuntu0.2
cacti
Ubuntu:16.04:LTS
 before 0.8.8f+ds1-4ubuntu4.16.04.2, plus listed versions
0.8.8f+ds1-20.8.8f+ds1-30.8.8f+ds1-40.8.8f+ds1-4ubuntu10.8.8f+ds1-4ubuntu2
Show 4 moreShow less
0.8.8f+ds1-4ubuntu30.8.8f+ds1-4ubuntu40.8.8f+ds1-4ubuntu4.16.040.8.8f+ds1-4ubuntu4.16.04.1
0.8.8f+ds1-4ubuntu4.16.04.2
cacti
openSUSE:Tumbleweed
From an advisory covering 18 CVEs
 before 0.8.8h-1.2
0.8.8h-1.2

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-3172 is a high vulnerability (CVSS 8.8) in Cacti, published April 12, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.83%, the 86th percentile. Fixed in cacti 0.8.8g-r1.

References

Show 26 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open