Unscored severity · published Feb 14, 2008
CVE-2008-0785
Multiple SQL injection vulnerabilities in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allow remote authenticated users to execute arbitrary SQL commands via the (1)…
–
CVSS
3.4%
EPSS
No
On KEV
Description
Multiple SQL injection vulnerabilities in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allow remote authenticated users to execute arbitrary SQL commands via the (1) graph_list parameter to graph_view.php, (2) leaf_id and id parameters to tree.php, (3) local_graph_id parameter to graph_xport.php, and (4) login_username parameter to index.php/login.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.4% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
Cacti · Cacti
0.6.7; 0.8; 0.8.1; 0.8.2; 0.8.2a; 0.8.3; +10 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-0785
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-0785
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html
Vendor Advisory
http://secunia.com/advisories/28872
secunia.com
http://secunia.com/advisories/28976
secunia.com
http://secunia.com/advisories/29242
secunia.com
http://secunia.com/advisories/29274
secunia.com
http://secunia.com/advisories/30045
More from Cacti
9.8
CVE-2022-46169
Unauthenticated Command Injection
9.8
CVE-2026-40079
Cacti: Command Injection via escape_command() no-op in RRDtool execution
9.8
CVE-2026-39948
Cacti has SQL Injection via rfilter parameter in RLIKE clauses
9.8
CVE-2026-39955
Cacti has Pre-Authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.php
9.8
CVE-2026-39938
Cacti: Unauthenticated RCE on Graph Image