Unscored severity · published Feb 14, 2008
CVE-2008-0786
CRLF injection vulnerability in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k, when running on older PHP interpreters, allows remote attackers to inject arbitrary HTTP headers…
–
CVSS
1.8%
EPSS
No
On KEV
Description
CRLF injection vulnerability in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k, when running on older PHP interpreters, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
Cacti · Cacti
0.6.7; 0.8; 0.8.1; 0.8.2; 0.8.2a; 0.8.3; +10 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-0786
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-0786
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html
Vendor Advisory
http://secunia.com/advisories/28872
secunia.com
http://secunia.com/advisories/28976
secunia.com
http://secunia.com/advisories/29242
secunia.com
http://secunia.com/advisories/29274
security.gentoo.org
http://security.gentoo.org/glsa/glsa-200803-18.xml
More from Cacti
9.8
CVE-2022-46169
Unauthenticated Command Injection
9.8
CVE-2026-40079
Cacti: Command Injection via escape_command() no-op in RRDtool execution
9.8
CVE-2026-39948
Cacti has SQL Injection via rfilter parameter in RLIKE clauses
9.8
CVE-2026-39955
Cacti has Pre-Authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.php
9.8
CVE-2026-39938
Cacti: Unauthenticated RCE on Graph Image