CVE-2018-20726
A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2...
A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname field for Devices.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname field for Devices.
- Record
CVE-2018-20726- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname field for Devices.
- Record
CVE-2018-20726- Updated
- 2026-11-02
EUVDEUVD-2018-13271 No score
A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname field for Devices.
- Record
EUVD-2018-13271- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-39rw-hw3x-2qp8
A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2...
A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname field for Devices.
- Record
GHSA-39rw-hw3x-2qp8- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname field for Devices.
- Record
CVE-2018-20726- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-20726
A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname field for Devices.
- Record
DEBIAN-CVE-2018-20726- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Show 6 moreShow less
OSVUBUNTU-CVE-2018-20726
A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname field for Devices.
- Record
UBUNTU-CVE-2018-20726- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2020:0272-1 No score
Security update for cacti, cacti-spine
This update for cacti, cacti-spine fixes the following issues:
cacti-spine was updated to version 1.2.9.
Security issues fixed:
- CVE-2009-4112: Fixed a privilege escalation (bsc#1122535).
- CVE-2018-20723: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122245).
- CVE-2018-20724: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122244).
- CVE-2018-20725: Fixed a privilege escalation that could occur under certain conditions (bsc#1122535).
- CVE-2018-20726: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122242).
- CVE-2019-16723: Fixed an authentication bypass vulnerability.
- CVE-2019-17357: Fixed an SQL injection vulnerability (bsc#1158990).
- CVE-2019-17358: Fixed an unsafe deserialization in sanitize_unserialize_selected_items (bsc#1158992).
- CVE-2020-7106: Fixed a potential cross-site scripting (XSS) vulnerability (bsc#1163749).
- CVE-2020-7237: Fixed a remote code execution that affected privileged users via shell metacharacters in the Performance Boost Debug Log field (bsc#1161297).
Non-security issues fixed:
- Fixed missing packages php-json, php-ctype, and php-gd in cacti.spec (boo#1101024).
- Fixed Apache2.4 and Apache2.2 runtime configuration issue (boo#1101139).
- Record
openSUSE-SU-2020:0272-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:0284-1 No score
Security update for cacti, cacti-spine
This update for cacti, cacti-spine fixes the following issues:
cacti-spine was updated to version 1.2.9.
Security issues fixed:
- CVE-2009-4112: Fixed a privilege escalation (bsc#1122535).
- CVE-2018-20723: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122245).
- CVE-2018-20724: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122244).
- CVE-2018-20725: Fixed a privilege escalation that could occur under certain conditions (bsc#1122535).
- CVE-2018-20726: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122242).
- CVE-2019-16723: Fixed an authentication bypass vulnerability.
- CVE-2019-17357: Fixed an SQL injection vulnerability (bsc#1158990).
- CVE-2019-17358: Fixed an unsafe deserialization in sanitize_unserialize_selected_items (bsc#1158992).
- CVE-2020-7106: Fixed a potential cross-site scripting (XSS) vulnerability (bsc#1163749).
- CVE-2020-7237: Fixed a remote code execution that affected privileged users via shell metacharacters in the Performance Boost Debug Log field (bsc#1161297).
Non-security issues fixed:
- Fixed missing packages php-json, php-ctype, and php-gd in cacti.spec (boo#1101024).
- Fixed Apache2.4 and Apache2.2 runtime configuration issue (boo#1101139).
This update was imported from the openSUSE:Leap:15.1:Update update project.
- Record
openSUSE-SU-2020:0284-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:0558-1 No score
Security update for cacti, cacti-spine
This update for cacti, cacti-spine to version 1.2.11 fixes the following issues:
This update is fixing multiple vulnerabilities and adding bug fixes. For more details consult the changes file.
- Record
openSUSE-SU-2020:0558-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:0565-1 No score
Security update for cacti, cacti-spine
This update for cacti, cacti-spine to version 1.2.11 fixes the following issues:
This update is fixing multiple vulnerabilities and adding bug fixes. For more details consult the changes file.
This update was imported from the openSUSE:Leap:15.1:Update update project.
- Record
openSUSE-SU-2020:0565-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10670-1 No score
cacti-1.2.18-1.2 on GA media
These are all security issues fixed in the cacti-1.2.18-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10670-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cactiDebian:12 |
before 1.2.1+ds1-1 | 1.2.1+ds1-1 |
cactiDebian:13 |
before 1.2.1+ds1-1 | 1.2.1+ds1-1 |
cactiDebian:14 |
before 1.2.1+ds1-1 | 1.2.1+ds1-1 |
cactiUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 0.8.8b+dfsg-30.8.8b+dfsg-50.8.8b+dfsg-5ubuntu0.10.8.8b+dfsg-5ubuntu0.20.8.8b+dfsg-5ubuntu0.2+esm10.8.8b+dfsg-5ubuntu0.2+esm2 |
None known |
cactiUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 0.8.8f+ds1-20.8.8f+ds1-30.8.8f+ds1-40.8.8f+ds1-4ubuntu10.8.8f+ds1-4ubuntu2 Show 7 moreShow less0.8.8f+ds1-4ubuntu30.8.8f+ds1-4ubuntu40.8.8f+ds1-4ubuntu4.16.040.8.8f+ds1-4ubuntu4.16.04.10.8.8f+ds1-4ubuntu4.16.04.20.8.8f+ds1-4ubuntu4.16.04.2+esm10.8.8f+ds1-4ubuntu4.16.04.2+esm2 |
None known |
cactiUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.1.18+ds1-11.1.27+ds1-21.1.27+ds1-31.1.28+ds1-21.1.35+ds1-1 Show 5 moreShow less1.1.36+ds1-11.1.38+ds1-11.1.38+ds1-1ubuntu0.1~esm11.1.38+ds1-1ubuntu0.1~esm31.1.38+ds1-1ubuntu0.1~esm4 |
None known |
cactiopenSUSE:Leap 15.1 From an advisory covering 10 CVEs |
before 1.2.9-lp151.3.3.1 | 1.2.9-lp151.3.3.1 |
cacti-spineopenSUSE:Leap 15.1 From an advisory covering 10 CVEs |
before 1.2.9-lp151.3.3.1 | 1.2.9-lp151.3.3.1 |
cactiSUSE:Package Hub 15 SP1 From an advisory covering 10 CVEs |
before 1.2.9-bp151.4.3.1 | 1.2.9-bp151.4.3.1 |
cacti-spineSUSE:Package Hub 15 SP1 From an advisory covering 10 CVEs |
before 1.2.9-bp151.4.3.1 | 1.2.9-bp151.4.3.1 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
cactiSUSE:Package Hub 12 From an advisory covering 11 CVEs |
before 1.2.11-5.1 | 1.2.11-5.1 |
cacti-spineSUSE:Package Hub 12 From an advisory covering 11 CVEs |
before 1.2.11-2.1 | 1.2.11-2.1 |
cactiopenSUSE:Leap 15.1 From an advisory covering 11 CVEs |
before 1.2.11-5.1 | 1.2.11-5.1 |
cacti-spineopenSUSE:Leap 15.1 From an advisory covering 11 CVEs |
before 1.2.11-2.1 | 1.2.11-2.1 |
cactiSUSE:Package Hub 15 SP1 From an advisory covering 11 CVEs |
before 1.2.11-bp151.4.6.1 | 1.2.11-bp151.4.6.1 |
cacti-spineSUSE:Package Hub 15 SP1 From an advisory covering 11 CVEs |
before 1.2.11-bp151.4.6.1 | 1.2.11-bp151.4.6.1 |
cactiopenSUSE:Tumbleweed From an advisory covering 31 CVEs |
before 1.2.18-1.2 | 1.2.18-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-20726 is a medium vulnerability (CVSS 5.4) in Cacti, published January 16, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.05%, the 64th percentile. Fixed in cacti 1.2.1+ds1-1.
References
github.com/Cacti/cacti/commit/80c2a88fb2afb93f87703ba4641f9970478c102d
lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html
Show 55 moreShow less
nvd.nist.gov/vuln/detail/CVE-2018-20726
security-tracker.debian.org/tracker/CVE-2018-20726
ubuntu.com/security/CVE-2018-20726
cve.org/CVERecord?id=CVE-2018-20726
bugzilla.suse.com/1082318
suse.com/security/cve/CVE-2009-4112