CVE-2009-4032

Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.7e allow remote attackers to...

4.3 MediumPublic exploitFix available

Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.7e allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) graph.php, (2) include/top_graph_header.php, (3) lib/html_form.php, and (4) lib/timespan_settings.php, as demonstrated by the (a) graph_end or (b) graph_start parameters to graph.php; (c) the date1 parameter in a tree action to graph_view.php; and the (d) page_refresh and (e) default_dual_pane_width parameters to graph_settings.php.

Exploit likelihood

5.74%Down 9.7 points since Feb 4, 2022

What each source reports

NVD Score used 4.3

Record: CVE-2009-4032
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Record: CVE-2009-4032
Updated: 2026-11-02

EUVDEUVD-2009-4003 No score

Record: EUVD-2009-4003
Updated: 2026-11-03

GitHub AdvisoriesGHSA-2chx-2wx9-x7f6 No score

Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.7e allow remote attackers to...

Record: GHSA-2chx-2wx9-x7f6
Weakness: CWE-79
Updated: 2026-11-02

OSV No score

Record: CVE-2009-4032
Updated: 2026-11-02

OSVDEBIAN-CVE-2009-4032 No score

Record: DEBIAN-CVE-2009-4032
Updated: 2026-11-02

Affected products

cacti

Affected packages

Affected packages
Package	Affected	Fixed
`cacti` Debian:12	before 0.8.7e-1.1	0.8.7e-1.1
`cacti` Debian:13	before 0.8.7e-1.1	0.8.7e-1.1
`cacti` Debian:14	before 0.8.7e-1.1	0.8.7e-1.1
`cacti` Debian:4.0	before 0.8.6i-3.6, plus listed versions 0.8.6i-30.8.6i-3.20.8.6i-3.30.8.6i-3.40.8.6i-3.5	0.8.6i-3.6
`cacti` Debian:5.0	before 0.8.7b-2.1+lenny1, plus listed versions 0.8.7b-2.1	0.8.7b-2.1+lenny1
`GeoIP` Red Hat:hpc_solution:1.0	before 0:1.4.7-0.1.20090931cvs.el5	0:1.4.7-0.1.20090931cvs.el5
`GeoIP-debuginfo` Red Hat:hpc_solution:1.0	before 0:1.4.7-0.1.20090931cvs.el5	0:1.4.7-0.1.20090931cvs.el5
`GeoIP-devel` Red Hat:hpc_solution:1.0	before 0:1.4.7-0.1.20090931cvs.el5	0:1.4.7-0.1.20090931cvs.el5
`blacs-mvapich1-gnu` Red Hat:hpc_solution:1.0	before 0:20000224-7	0:20000224-7
`blacs-mvapich1-gnu-debuginfo` Red Hat:hpc_solution:1.0	before 0:20000224-7	0:20000224-7

Show 137 moreShow less

Affected packages
Package	Affected	Fixed
`blacs-openmpi-gnu` Red Hat:hpc_solution:1.0	before 0:20000224-9	0:20000224-9
`blacs-openmpi-gnu-debuginfo` Red Hat:hpc_solution:1.0	before 0:20000224-9	0:20000224-9
`cacti` Red Hat:hpc_solution:1.0	before 0:0.8.7g-1.1.el5	0:0.8.7g-1.1.el5
`component-RHEL-OFED` Red Hat:hpc_solution:1.0	before 0:5.5-2	0:5.5-2
`component-RHEL-OFED-devel` Red Hat:hpc_solution:1.0	before 0:5.5-1	0:5.5-1
`component-base-installer` Red Hat:hpc_solution:1.0	before 0:5.5-1	0:5.5-1
`component-base-node` Red Hat:hpc_solution:1.0	before 0:5.5-1	0:5.5-1
`component-cacti` Red Hat:hpc_solution:1.0	before 0:0.1-49	0:0.1-49
`component-ganglia-agent-v3_0` Red Hat:hpc_solution:1.0	before 0:3.0-3.el5	0:3.0-3.el5
`component-ganglia-server-v3_0` Red Hat:hpc_solution:1.0	before 0:3.0-3	0:3.0-3
`component-gnome-desktop` Red Hat:hpc_solution:1.0	before 0:5.5-1	0:5.5-1
`component-icr-facilitator` Red Hat:hpc_solution:1.0	before 0:5.5-1	0:5.5-1
`component-lava-compute-v1_0` Red Hat:hpc_solution:1.0	before 0:1.0-6	0:1.0-6
`component-mvapich1-libraries` Red Hat:hpc_solution:1.0	before 0:0.1-4	0:0.1-4
`component-nagios-installer-v2_12` Red Hat:hpc_solution:1.0	before 0:2.12-4	0:2.12-4
`component-ntop-v3_3` Red Hat:hpc_solution:1.0	before 0:3.3-12	0:3.3-12
`environment-modules` Red Hat:hpc_solution:1.0	before 0:3.2.7b-7.el5	0:3.2.7b-7.el5
`environment-modules-debuginfo` Red Hat:hpc_solution:1.0	before 0:3.2.7b-7.el5	0:3.2.7b-7.el5
`initrd-templates` Red Hat:hpc_solution:1.0	before 0:5.5-1	0:5.5-1
`iozone` Red Hat:hpc_solution:1.0	before 0:3-5.el5	0:3-5.el5
`iozone-debuginfo` Red Hat:hpc_solution:1.0	before 0:3-5.el5	0:3-5.el5
`kit-base` Red Hat:hpc_solution:1.0	before 0:5.5-1	0:5.5-1
`kit-cacti` Red Hat:hpc_solution:1.0	before 0:0.8.7-47	0:0.8.7-47
`kit-ganglia` Red Hat:hpc_solution:1.0	before 0:3.0-8	0:3.0-8
`kit-hpc` Red Hat:hpc_solution:1.0	before 0:0.1-5	0:0.1-5
`kit-lava` Red Hat:hpc_solution:1.0	before 0:1.0-11	0:1.0-11
`kit-nagios` Red Hat:hpc_solution:1.0	before 0:2.12-6	0:2.12-6
`kit-ntop` Red Hat:hpc_solution:1.0	before 0:3.3-13	0:3.3-13
`kit-rhel-ofed` Red Hat:hpc_solution:1.0	before 0:5.5-1	0:5.5-1
`kit-rhel_java` Red Hat:hpc_solution:1.0	before 0:1.6.0-3.el5	0:1.6.0-3.el5
`kusu-appglobals-tool` Red Hat:hpc_solution:1.0	before 0:5.5-1.el5	0:5.5-1.el5
`kusu-autoinstall` Red Hat:hpc_solution:1.0	before 0:5.5-1	0:5.5-1
`kusu-base-installer` Red Hat:hpc_solution:1.0	before 0:5.5-2	0:5.5-2
`kusu-base-node` Red Hat:hpc_solution:1.0	before 0:5.5-1	0:5.5-1
`kusu-base-node-debuginfo` Red Hat:hpc_solution:1.0	before 0:5.5-1	0:5.5-1
`kusu-boot` Red Hat:hpc_solution:1.0	before 0:5.5-1	0:5.5-1
`kusu-buildkit` Red Hat:hpc_solution:1.0	before 0:5.5-1	0:5.5-1
`kusu-core` Red Hat:hpc_solution:1.0	before 0:5.5-1	0:5.5-1
`kusu-driverpatch` Red Hat:hpc_solution:1.0	before 0:5.5-1	0:5.5-1
`kusu-hardware` Red Hat:hpc_solution:1.0	before 0:5.5-1	0:5.5-1
`kusu-installer` Red Hat:hpc_solution:1.0	before 0:5.5-1	0:5.5-1
`kusu-kitops` Red Hat:hpc_solution:1.0	before 0:5.5-1	0:5.5-1
`kusu-md5crypt` Red Hat:hpc_solution:1.0	before 0:5.5-1	0:5.5-1
`kusu-net-tool` Red Hat:hpc_solution:1.0	before 0:5.5-1	0:5.5-1
`kusu-networktool` Red Hat:hpc_solution:1.0	before 0:5.5-1	0:5.5-1
`kusu-nodeinstaller` Red Hat:hpc_solution:1.0	before 0:5.5-1	0:5.5-1
`kusu-nodeinstaller-patchfiles` Red Hat:hpc_solution:1.0	before 0:5.5-1	0:5.5-1
`kusu-path` Red Hat:hpc_solution:1.0	before 0:5.5-1	0:5.5-1
`kusu-release` Red Hat:hpc_solution:1.0	before 0:5.5-1	0:5.5-1
`kusu-repoman` Red Hat:hpc_solution:1.0	before 0:5.5-1	0:5.5-1
`kusu-ui` Red Hat:hpc_solution:1.0	before 0:5.5-1	0:5.5-1
`kusu-util` Red Hat:hpc_solution:1.0	before 0:5.5-1	0:5.5-1
`lava` Red Hat:hpc_solution:1.0	before 0:1.0-10	0:1.0-10
`lava-debuginfo` Red Hat:hpc_solution:1.0	before 0:1.0-10	0:1.0-10
`lava-devel` Red Hat:hpc_solution:1.0	before 0:1.0-10	0:1.0-10
`lava-master-config` Red Hat:hpc_solution:1.0	before 0:1.0-10	0:1.0-10
`lava-static` Red Hat:hpc_solution:1.0	before 0:1.0-10	0:1.0-10
`linpack-mvapich1-gnu` Red Hat:hpc_solution:1.0	before 0:1.0a-7	0:1.0a-7
`linpack-openmpi-gnu` Red Hat:hpc_solution:1.0	before 0:1.0a-6	0:1.0a-6
`nagios-plugins` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-all` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-apt` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-breeze` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-by_ssh` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-cluster` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-debuginfo` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-dhcp` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-dig` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-disk` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-disk_smb` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-dns` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-dummy` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-file_age` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-flexlm` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-fping` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-hpjd` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-http` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-icmp` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-ide_smart` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-ifoperstatus` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-ifstatus` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-ircd` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-ldap` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-linux_raid` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-load` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-log` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-mailq` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-mrtg` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-mrtgtraf` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-mysql` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-nagios` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-nrpe` Red Hat:hpc_solution:1.0	before 0:2.12-12.1.el5	0:2.12-12.1.el5
`nagios-plugins-nt` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-ntp` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-nwstat` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-oracle` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-overcr` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-perl` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-pgsql` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-ping` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-procs` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-radius` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-real` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-rpc` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-sensors` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-smtp` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-snmp` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-ssh` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-swap` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-tcp` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-time` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-udp` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-ups` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-users` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`nagios-plugins-wave` Red Hat:hpc_solution:1.0	before 0:1.4.14-1.1.el5	0:1.4.14-1.1.el5
`netcdf` Red Hat:hpc_solution:1.0	before 0:3.6.2-7.el5	0:3.6.2-7.el5
`netcdf-debuginfo` Red Hat:hpc_solution:1.0	before 0:3.6.2-7.el5	0:3.6.2-7.el5
`netcdf-devel` Red Hat:hpc_solution:1.0	before 0:3.6.2-7.el5	0:3.6.2-7.el5
`nrpe` Red Hat:hpc_solution:1.0	before 0:2.12-12.1.el5	0:2.12-12.1.el5
`nrpe-debuginfo` Red Hat:hpc_solution:1.0	before 0:2.12-12.1.el5	0:2.12-12.1.el5
`ntop` Red Hat:hpc_solution:1.0	before 0:3.3.9-7.1.el5	0:3.3.9-7.1.el5
`ntop-debuginfo` Red Hat:hpc_solution:1.0	before 0:3.3.9-7.1.el5	0:3.3.9-7.1.el5
`pcm` Red Hat:hpc_solution:1.0	before 0:1.2-6	0:1.2-6
`pcm-kit-base` Red Hat:hpc_solution:1.0	before 0:1.2-4	0:1.2-4
`pcm-kit-hpc` Red Hat:hpc_solution:1.0	before 0:1.0-22	0:1.0-22
`pcm-kit-ntop` Red Hat:hpc_solution:1.0	before 0:1.1-2	0:1.1-2
`platform_mvapich` Red Hat:hpc_solution:1.0	before 0:1.2.0-0.3635.1.el5	0:1.2.0-0.3635.1.el5
`primitive` Red Hat:hpc_solution:1.0	before 0:0.1.1-2	0:0.1.1-2
`python-IPy` Red Hat:hpc_solution:1.0	before 0:0.70-1.el5	0:0.70-1.el5
`python-psycopg2` Red Hat:hpc_solution:1.0	before 0:2.0.14-1.el5	0:2.0.14-1.el5
`python-psycopg2-debuginfo` Red Hat:hpc_solution:1.0	before 0:2.0.14-1.el5	0:2.0.14-1.el5
`python-psycopg2-doc` Red Hat:hpc_solution:1.0	before 0:2.0.14-1.el5	0:2.0.14-1.el5
`python-psycopg2-zope` Red Hat:hpc_solution:1.0	before 0:2.0.14-1.el5	0:2.0.14-1.el5
`scalapack-mvapich1-gnu` Red Hat:hpc_solution:1.0	before 0:1.8.0-9	0:1.8.0-9
`scalapack-mvapich1-gnu-debuginfo` Red Hat:hpc_solution:1.0	before 0:1.8.0-9	0:1.8.0-9
`scalapack-openmpi-gnu` Red Hat:hpc_solution:1.0	before 0:1.8.0-9	0:1.8.0-9
`scalapack-openmpi-gnu-debuginfo` Red Hat:hpc_solution:1.0	before 0:1.8.0-9	0:1.8.0-9

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Cacti 0.8.7e - Multiple Vulnerabilities	2009-11-26
Exploit-DB	Cacti 0.8.x - 'graph.php' Multiple Cross-Site Scripting Vulnerabilities	2009-11-21

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2009-4032 is a medium vulnerability (CVSS 4.3) in Cacti, published November 27, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 5.74%, the 93rd percentile. Fixed in cacti 0.8.7e-1.1.

References

Show 52 moreShow less