CVE-2015-4634
SQL injection vulnerability in graphs.php in Cacti before 0.8.8e allows remote attackers to...
SQL injection vulnerability in graphs.php in Cacti before 0.8.8e allows remote attackers to execute arbitrary SQL commands via the local_graph_id parameter.
Exploit likelihood
What each source reports
NVD Score used
SQL injection vulnerability in graphs.php in Cacti before 0.8.8e allows remote attackers to execute arbitrary SQL commands via the local_graph_id parameter.
- Record
CVE-2015-4634- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-89
- Updated
- 2026-11-02
CVE List No score
SQL injection vulnerability in graphs.php in Cacti before 0.8.8e allows remote attackers to execute arbitrary SQL commands via the local_graph_id parameter.
- Record
CVE-2015-4634- Updated
- 2026-11-02
EUVDEUVD-2015-4653 No score
SQL injection vulnerability in graphs.php in Cacti before 0.8.8e allows remote attackers to execute arbitrary SQL commands via the local_graph_id parameter.
- Record
EUVD-2015-4653- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j268-9gfj-xh5m No score
SQL injection vulnerability in graphs.php in Cacti before 0.8.8e allows remote attackers to...
SQL injection vulnerability in graphs.php in Cacti before 0.8.8e allows remote attackers to execute arbitrary SQL commands via the local_graph_id parameter.
- Record
GHSA-j268-9gfj-xh5m- Weakness
- CWE-89
- Updated
- 2026-11-02
OSV No score
SQL injection vulnerability in graphs.php in Cacti before 0.8.8e allows remote attackers to execute arbitrary SQL commands via the local_graph_id parameter.
- Record
CVE-2015-4634- Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-4634 No score
SQL injection vulnerability in graphs.php in Cacti before 0.8.8e allows remote attackers to execute arbitrary SQL commands via the local_graph_id parameter.
- Record
DEBIAN-CVE-2015-4634- Updated
- 2026-11-02
OSVMGASA-2015-0306 No score
Updated cacti package fixes security vulnerability
Cross-site scripting (XSS) vulnerability in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors (CVE-2015-2665).
SQL injection vulnerability in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via unspecified vectors involving a cdef id (CVE-2015-4342).
SQL injection vulnerability in the get_hash_graph_template function in lib/functions.php in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via the graph_template_id parameter to graph_templates.php (CVE-2015-4454).
SQL injection vulnerability in Cacti before 0.8.8e in graphs.php (CVE-2015-4634).
The cacti package has been updated to version 0.8.8e, which fixes this issue, as well as other SQL injection and XSS issues and other bugs
- Record
MGASA-2015-0306- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10084-1 No score
cacti-0.8.8h-1.2 on GA media
These are all security issues fixed in the cacti-0.8.8h-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10084-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-4634 No score
SQL injection vulnerability in graphs.php in Cacti before 0.8.8e allows remote attackers to execute arbitrary SQL commands via the local_graph_id parameter.
- Record
UBUNTU-CVE-2015-4634- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cactiDebian:12 |
before 0.8.8e+ds1-1 | 0.8.8e+ds1-1 |
cactiDebian:13 |
before 0.8.8e+ds1-1 | 0.8.8e+ds1-1 |
cactiDebian:14 |
before 0.8.8e+ds1-1 | 0.8.8e+ds1-1 |
cactiDebian:6.0 |
before 0.8.7g-1+squeeze7, plus listed versions 0.8.7g-10.8.7g-1+squeeze10.8.7g-1+squeeze20.8.7g-1+squeeze30.8.7g-1+squeeze40.8.7g-1+squeeze50.8.7g-1+squeeze6 |
0.8.7g-1+squeeze7 |
cactiDebian:7 |
before 0.8.8a+dfsg-5+deb7u6, plus listed versions 0.8.8a+dfsg-50.8.8a+dfsg-5+deb7u10.8.8a+dfsg-5+deb7u20.8.8a+dfsg-5+deb7u30.8.8a+dfsg-5+deb7u40.8.8a+dfsg-5+deb7u5 |
0.8.8a+dfsg-5+deb7u6 |
cactiDebian:8 |
before 0.8.8b+dfsg-8+deb8u2, plus listed versions 0.8.8b+dfsg-80.8.8b+dfsg-8+deb8u1 |
0.8.8b+dfsg-8+deb8u2 |
cactiMageia:4 From an advisory covering 4 CVEs |
before 0.8.8f-1.mga4 | 0.8.8f-1.mga4 |
cactiMageia:5 From an advisory covering 4 CVEs |
before 0.8.8f-1.mga5 | 0.8.8f-1.mga5 |
cactiUbuntu:14.04:LTS |
before 0.8.8b+dfsg-5ubuntu0.2, plus listed versions 0.8.8b+dfsg-30.8.8b+dfsg-50.8.8b+dfsg-5ubuntu0.1 |
0.8.8b+dfsg-5ubuntu0.2 |
cactiopenSUSE:Tumbleweed From an advisory covering 18 CVEs |
before 0.8.8h-1.2 | 0.8.8h-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-4634 is a high vulnerability (CVSS 7.5) in Cacti, published July 19, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.18%, the 82nd percentile. Fixed in cacti 0.8.8e+ds1-1.
References
lists.opensuse.org/opensuse-updates/2015-07/msg00052.html
securitytracker.com/id/1032989
cacti.net/release_notes_0_8_8e.php
debian.org/security/2015/dsa-3312
bugs.cacti.net/view.php?id=2577
nvd.nist.gov/vuln/detail/CVE-2015-4634
Show 27 moreShow less
github.com/advisories/GHSA-j268-9gfj-xh5m
security-tracker.debian.org/tracker/CVE-2015-4634
advisories.mageia.org/MGASA-2015-0306.html
bugs.mageia.org/show_bug.cgi?id=16202
ubuntu.com/security/CVE-2015-4634
cve.org/CVERecord?id=CVE-2015-4634
suse.com/security/cve/CVE-2013-5588