CVE-2018-10060
Cacti before 1.1.37 has XSS because it does not properly reject unintended characters, related to...
Cacti before 1.1.37 has XSS because it does not properly reject unintended characters, related to use of the sanitize_uri function in lib/functions.php.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Cacti before 1.1.37 has XSS because it does not properly reject unintended characters, related to use of the sanitize_uri function in lib/functions.php.
- Record
CVE-2018-10060- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cacti before 1.1.37 has XSS because it does not properly reject unintended characters, related to use of the sanitize_uri function in lib/functions.php.
- Record
CVE-2018-10060- Updated
- 2026-11-02
EUVDEUVD-2018-2142 No score
Cacti before 1.1.37 has XSS because it does not properly reject unintended characters, related to use of the sanitize_uri function in lib/functions.php.
- Record
EUVD-2018-2142- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qw2p-jwcj-4m42
Cacti before 1.1.37 has XSS because it does not properly reject unintended characters, related to...
Cacti before 1.1.37 has XSS because it does not properly reject unintended characters, related to use of the sanitize_uri function in lib/functions.php.
- Record
GHSA-qw2p-jwcj-4m42- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Cacti before 1.1.37 has XSS because it does not properly reject unintended characters, related to use of the sanitize_uri function in lib/functions.php.
- Record
CVE-2018-10060- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-10060
Cacti before 1.1.37 has XSS because it does not properly reject unintended characters, related to use of the sanitize_uri function in lib/functions.php.
- Record
DEBIAN-CVE-2018-10060- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-10060
Cacti before 1.1.37 has XSS because it does not properly reject unintended characters, related to use of the sanitize_uri function in lib/functions.php.
- Record
UBUNTU-CVE-2018-10060- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cactiDebian:12 |
before 1.1.37+ds1-1 | 1.1.37+ds1-1 |
cactiDebian:13 |
before 1.1.37+ds1-1 | 1.1.37+ds1-1 |
cactiDebian:14 |
before 1.1.37+ds1-1 | 1.1.37+ds1-1 |
cactiDebian:9 |
before 0.8.8h+ds1-10+deb9u2, plus listed versions 0.8.8h+ds1-100.8.8h+ds1-10+deb9u1 |
0.8.8h+ds1-10+deb9u2 |
cactiUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 0.8.8b+dfsg-30.8.8b+dfsg-50.8.8b+dfsg-5ubuntu0.10.8.8b+dfsg-5ubuntu0.20.8.8b+dfsg-5ubuntu0.2+esm10.8.8b+dfsg-5ubuntu0.2+esm2 |
None known |
cactiUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 0.8.8f+ds1-20.8.8f+ds1-30.8.8f+ds1-40.8.8f+ds1-4ubuntu10.8.8f+ds1-4ubuntu2 Show 7 moreShow less0.8.8f+ds1-4ubuntu30.8.8f+ds1-4ubuntu40.8.8f+ds1-4ubuntu4.16.040.8.8f+ds1-4ubuntu4.16.04.10.8.8f+ds1-4ubuntu4.16.04.20.8.8f+ds1-4ubuntu4.16.04.2+esm10.8.8f+ds1-4ubuntu4.16.04.2+esm2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-10060 is a medium vulnerability (CVSS 5.4) in Cacti, published April 12, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.00%, the 62nd percentile. Fixed in cacti 1.1.37+ds1-1.
References
github.com/Cacti/cacti/issues/1457
cacti.net/changelog.php
securitytracker.com/id/1040620
lists.debian.org/debian-lts-announce/2022/03/msg00038.html
nvd.nist.gov/vuln/detail/CVE-2018-10060
security-tracker.debian.org/tracker/CVE-2018-10060
ubuntu.com/security/CVE-2018-10060
cve.org/CVERecord?id=CVE-2018-10060