CVE-2015-2665
Cross-site scripting (XSS) vulnerability in Cacti before 0.8.8d allows remote attackers to inject...
Cross-site scripting (XSS) vulnerability in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Record
CVE-2015-2665- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Record
CVE-2015-2665- Updated
- 2026-11-02
EUVDEUVD-2015-2757 No score
Cross-site scripting (XSS) vulnerability in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Record
EUVD-2015-2757- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g258-xc2f-gxcj No score
Cross-site scripting (XSS) vulnerability in Cacti before 0.8.8d allows remote attackers to inject...
Cross-site scripting (XSS) vulnerability in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Record
GHSA-g258-xc2f-gxcj- Weakness
- CWE-79
- Updated
- 2026-11-02
OSV No score
Cross-site scripting (XSS) vulnerability in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Record
CVE-2015-2665- Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-2665 No score
Cross-site scripting (XSS) vulnerability in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Record
DEBIAN-CVE-2015-2665- Updated
- 2026-11-02
OSVMGASA-2015-0306 No score
Updated cacti package fixes security vulnerability
Cross-site scripting (XSS) vulnerability in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors (CVE-2015-2665).
SQL injection vulnerability in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via unspecified vectors involving a cdef id (CVE-2015-4342).
SQL injection vulnerability in the get_hash_graph_template function in lib/functions.php in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via the graph_template_id parameter to graph_templates.php (CVE-2015-4454).
SQL injection vulnerability in Cacti before 0.8.8e in graphs.php (CVE-2015-4634).
The cacti package has been updated to version 0.8.8e, which fixes this issue, as well as other SQL injection and XSS issues and other bugs
- Record
MGASA-2015-0306- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-2665 No score
Cross-site scripting (XSS) vulnerability in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Record
UBUNTU-CVE-2015-2665- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cactiDebian:12 |
before 0.8.8d+ds1-1 | 0.8.8d+ds1-1 |
cactiDebian:13 |
before 0.8.8d+ds1-1 | 0.8.8d+ds1-1 |
cactiDebian:14 |
before 0.8.8d+ds1-1 | 0.8.8d+ds1-1 |
cactiDebian:6.0 From an advisory covering 4 CVEs |
before 0.8.7g-1+squeeze6, plus listed versions 0.8.7g-10.8.7g-1+squeeze10.8.7g-1+squeeze20.8.7g-1+squeeze30.8.7g-1+squeeze40.8.7g-1+squeeze5 |
0.8.7g-1+squeeze6 |
cactiDebian:7 From an advisory covering 4 CVEs |
before 0.8.8a+dfsg-5+deb7u5, plus listed versions 0.8.8a+dfsg-50.8.8a+dfsg-5+deb7u10.8.8a+dfsg-5+deb7u20.8.8a+dfsg-5+deb7u30.8.8a+dfsg-5+deb7u4 |
0.8.8a+dfsg-5+deb7u5 |
cactiDebian:8 From an advisory covering 4 CVEs |
before 0.8.8b+dfsg-8+deb8u1, plus listed versions 0.8.8b+dfsg-8 |
0.8.8b+dfsg-8+deb8u1 |
cactiMageia:4 From an advisory covering 4 CVEs |
before 0.8.8f-1.mga4 | 0.8.8f-1.mga4 |
cactiMageia:5 From an advisory covering 4 CVEs |
before 0.8.8f-1.mga5 | 0.8.8f-1.mga5 |
cactiUbuntu:14.04:LTS |
before 0.8.8b+dfsg-5ubuntu0.1, plus listed versions 0.8.8b+dfsg-30.8.8b+dfsg-5 |
0.8.8b+dfsg-5ubuntu0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-2665 is a medium vulnerability (CVSS 4.3) in Cacti, published June 17, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.14%, the 82nd percentile. Fixed in cacti 0.8.8d+ds1-1.
References
lists.fedoraproject.org/pipermail/package-announce/2016-May/183449.html
cacti.net/release_notes_0_8_8d.php
securitytracker.com/id/1032672
fortiguard.com/advisory/FG-VD-15-017
securityfocus.com/bid/75309
Show 11 moreShow less
debian.org/security/2015/dsa-3295
nvd.nist.gov/vuln/detail/CVE-2015-2665
github.com/advisories/GHSA-g258-xc2f-gxcj
security-tracker.debian.org/tracker/CVE-2015-2665
advisories.mageia.org/MGASA-2015-0306.html
bugs.mageia.org/show_bug.cgi?id=16202
ubuntu.com/security/CVE-2015-2665
cve.org/CVERecord?id=CVE-2015-2665