Skip to contentCacti vulnerabilities
Newest
- cactiSQL Injection vulnerability in Cacti v1.2.25 allows a remote attacker to obtain sensitive...CVE-2023-46490Fix available6.5 Medium
- cacti, fedoraproject fedora +1 moreStored Cross-Site-Scripting on reports_admin.php device name in CactiCVE-2023-39511Fix available6.1 Medium
- cacti, fedoraproject fedora +1 moreInsecure Deserialization in CactiCVE-2023-30534Fix available4.3 Medium
- cactiCacti Privilege EscalationCVE-2023-311327.8 High
- cacti, fedoraproject fedora +1 moreAuthenticated command injection in SNMP options of a DeviceCVE-2023-39362Public exploitFix availableEPSS 84.8%7.2 High
- cacti, fedoraproject fedora +1 moreOpen redirect in change password functionality in CactiCVE-2023-39364Fix available3.5 Low
- cacti, fedoraproject fedora +1 moreStored Cross-Site-Scripting on data_sources.php debug html-block in CactiCVE-2023-39516Fix available6.1 Medium
- cacti, fedoraproject fedora +1 moreUnchecked regular expressions can lead to SQL Injection and data leakage in CactiCVE-2023-39365Fix available4.6 Medium
- cacti, fedoraproject fedora +1 moreA Defect in sql_save() Causes Multiple SQL Injection Vulnerabilities in CactiCVE-2023-39357Fix available8.8 High
- cacti, fedoraproject fedora +1 moreAuthenticated SQL injection vulnerability in reports_user.php in CactiCVE-2023-39358Fix available8.8 High
- cacti, fedoraproject fedora +1 moreAuthenticated SQL injection vulnerability in graphs.php in CactiCVE-2023-39359Fix available8.8 High
- cacti, fedoraproject fedora +1 moreUnauthenticated SQL Injection in graph_view.php in CactiCVE-2023-39361Public exploitFix availableEPSS 88.8%9.8 Critical
- cacti, fedoraproject fedora +1 moreReflected Cross-site Scripting in graphs_new.php in CactiCVE-2023-39360Fix available6.1 Medium
- cacti, fedoraproject fedora +1 moreStored Cross-site Scripting in data_sources.php through Device-Name in 'select' input in CactiCVE-2023-39366Fix available6.1 Medium
- cacti, fedoraproject fedora +1 moreStored Cross-site Scripting in reports_admin.php through Device-Name in 'select' input in CactiCVE-2023-39510Fix available6.1 Medium
- cacti, fedoraproject fedora +1 moreStored Cross-site Scripting on data_sources.php device name view in CactiCVE-2023-39512Fix available6.1 Medium
- cacti, fedoraproject fedora +1 moreStored Cross-site Scripting on host.php verbose data-query debug view in CactiCVE-2023-39513Fix available6.1 Medium
- cacti, fedoraproject fedora +1 moreStored Cross-site Scripting on data_debug.php datasource path view in CactiCVE-2023-39515Fix available6.1 Medium
- cacti, fedoraproject fedora +1 moreStored Cross-site Scripting on graphs.php data template formated name view in CactiCVE-2023-39514Fix available6.1 Medium
- cactiA reflected cross-site scripting (XSS) vulnerability in Cacti 0.8.7g and earlier allows...CVE-2022-48547Fix available6.1 Medium
- cactiIn Cacti 1.2.19, there is an authentication bypass in the web login functionality because of...CVE-2022-48538Fix available5.3 Medium
- cactiCross Site Scripting (XSS) vulnerability in Cacti 1.2.21 via crafted POST request to graphs_new.php.CVE-2022-41444Fix available6.1 Medium
- cactiCacti before 1.2.6 allows IDOR (Insecure Direct Object Reference) for accessing any graph via a...CVE-2023-37543Fix available7.5 High
- cactiUnauthenticated Command InjectionCVE-2022-46169In KEVPublic exploitFix availableEPSS 99.8%9.8 Critical
- cacti, debian linux, fedoraproject fedora +2 moreUnder certain ldap conditions, Cacti authentication can be bypassed with certain credential types.CVE-2022-0730Fix available9.8 Critical
- cactiAs an unauthenticated remote user, visit "http://<CACTI_SERVER>/auth_changepassword.php?ref=...CVE-2021-26247Fix available6.1 Medium
- cacti, debian linux +1 moreCacti 1.1.38 allows authenticated users with User Management permissions to inject arbitrary web...CVE-2021-23225Fix available5.4 Medium
- cactiCacti 1.1.38 allows authenticated users with User Management permissions to inject arbitrary HTML...CVE-2021-3816Fix available5.4 Medium
- cacti, debian linux +1 moreMultiple Cross Site Scripting (XSS) vulneratiblities exist in Cacti 1.2.12 in (1) reports_admin...CVE-2020-23226Fix available6.1 Medium
- cactiCacti before 1.2.18 allows remote attackers to trigger XSS via template import for the midwinter...CVE-2020-14424Fix available6.1 Medium
- cacti, fedoraproject fedora +1 moreAn issue was discovered in Cacti 1.2.x through 1.2.16. A SQL injection vulnerability in...CVE-2020-35701Fix available8.8 High
- cacti, debian linux +1 moreA cross-site scripting (XSS) vulnerability exists in templates_import.php (Cacti 1.2.13) due to...CVE-2020-25706Fix available5.4 Medium
- cacti, fedoraproject fedora +1 moreA SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter...CVE-2020-14295Public exploitFix availableEPSS 86.1%7.2 High
- cacti, fedoraproject fedora +1 moreIn Cacti before 1.2.11, auth_profile.php?action=edit allows CSRF for an admin email change.CVE-2020-13231Fix available6.5 Medium
- cacti, debian linux, fedoraproject fedora +2 moreIn Cacti before 1.2.11, disabling a user account does not immediately invalidate any permissions...CVE-2020-13230Fix available4.3 Medium
- cacti, debian linux, fedoraproject fedora +2 more +4 moregraph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via...CVE-2020-8813Public exploitFix availableEPSS 73.9%8.8 High
- cactiCacti through 1.2.7 is affected by a graphs.php?template_id= SQL injection vulnerability...CVE-2019-17357Fix availableEPSS 34.2%6.5 Medium
- cactiCacti 1.2.8 allows Remote Code Execution (by privileged users) via shell metacharacters in the...CVE-2020-7237Fix availableEPSS 37.1%8.8 High
- cacti, debian linux, fedoraproject extra packages for enterprise linux +4 more +6 moreCacti 1.2.8 has stored XSS in data_sources.php, color_templates_item.php, graphs.php, graph_items...CVE-2020-7106Fix available6.1 Medium
- cacti** DISPUTED ** data_input.php in Cacti 1.2.8 allows remote code execution via a crafted Input...CVE-2020-7058Disputed8.8 High
- cacti, debian linux, opensuse leap +2 moreCacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization...CVE-2019-17358Fix available8.1 High
- cactiIn Cacti through 1.2.6, authenticated users may bypass authorization checks (for viewing a graph)...CVE-2019-16723Fix available4.3 Medium
- cacti, debian linux +1 moreIn clearFilter() in utilities.php in Cacti before 1.2.3, no escaping occurs before printing out...CVE-2019-11025Fix available5.4 Medium
- cactiA cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2...CVE-2018-20726Fix available5.4 Medium
- cactiA cross-site scripting (XSS) vulnerability exists in graph_templates.php in Cacti before 1.2.0...CVE-2018-20725Fix available4.8 Medium
- cactiA cross-site scripting (XSS) vulnerability exists in pollers.php in Cacti before 1.2.0 due to...CVE-2018-20724Fix available4.8 Medium
- cactiA cross-site scripting (XSS) vulnerability exists in color_templates.php in Cacti before 1.2.0...CVE-2018-20723Fix available4.8 Medium
- cacti, debian linux +1 moreCacti before 1.1.37 has XSS because it makes certain htmlspecialchars calls without the...CVE-2018-10061Fix available5.4 Medium
- cacti, debian linux +1 moreCacti before 1.1.37 has XSS because it does not properly reject unintended characters, related to...CVE-2018-10060Fix available5.4 Medium
- cactiCacti before 1.1.37 has XSS because the get_current_page function in lib/functions.php relies on ...CVE-2018-10059Fix available5.4 Medium
- Show moreLoading…