CVE-2004-1737
SQL injection vulnerability in auth_login.php in Cacti 0.8.5a allows remote attackers to execute...
SQL injection vulnerability in auth_login.php in Cacti 0.8.5a allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username or (2) password parameters.
Exploit likelihood
What each source reports
NVD Score used
SQL injection vulnerability in auth_login.php in Cacti 0.8.5a allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username or (2) password parameters.
- Record
CVE-2004-1737- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
SQL injection vulnerability in auth_login.php in Cacti 0.8.5a allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username or (2) password parameters.
- Record
CVE-2004-1737- Updated
- 2026-11-02
EUVDEUVD-2004-1731 No score
SQL injection vulnerability in auth_login.php in Cacti 0.8.5a allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username or (2) password parameters.
- Record
EUVD-2004-1731- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v3h5-fhg8-jp65 No score
SQL injection vulnerability in auth_login.php in Cacti 0.8.5a allows remote attackers to execute...
SQL injection vulnerability in auth_login.php in Cacti 0.8.5a allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username or (2) password parameters.
- Record
GHSA-v3h5-fhg8-jp65- Updated
- 2026-11-02
OSV No score
SQL injection vulnerability in auth_login.php in Cacti 0.8.5a allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username or (2) password parameters.
- Record
CVE-2004-1737- Updated
- 2026-11-02
OSVDEBIAN-CVE-2004-1737 No score
SQL injection vulnerability in auth_login.php in Cacti 0.8.5a allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username or (2) password parameters.
- Record
DEBIAN-CVE-2004-1737- Updated
- 2026-11-02
Affected products
Affected packages
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | RaXnet Cacti 0.6.x/0.8.x - 'Auth_Login.php' SQL Injection | 2004-07-16 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2004-1737 is a high vulnerability (CVSS 7.5) in The Cacti Group Cacti, published August 16, 2004. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.83%, the 86th percentile. Fixed in cacti 0.8.5a-5.
References
lists.grok.org.uk/pipermail/full-disclosure/2004-August/025376.html
exchange.xforce.ibmcloud.com/vulnerabilities/17011
securityfocus.com/bid/10960
secunia.com/advisories/12308
marc.info?l=bugtraq&m=109272483621038&w=2
gentoo.org/security/en/glsa/glsa-200408-21.xml
nvd.nist.gov/vuln/detail/CVE-2004-1737
github.com/advisories/GHSA-v3h5-fhg8-jp65
security-tracker.debian.org/tracker/CVE-2004-1737