Unscored severity · published Jul 10, 2015
CVE-2015-2967
Cross-site scripting (XSS) vulnerability in settings.php in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors
–
CVSS
1.8%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in settings.php in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 79% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
Cacti · Cacti
through 0.8.8c · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-2967
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-2967
Vendor Advisory
http://jvn.jp/en/jp/JVN78187936/index.html
Vendor Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2015-000094
Vendor Advisory
http://www.cacti.net/release_notes_0_8_8d.php
www.securitytracker.com
http://www.securitytracker.com/id/1032672
security.gentoo.org
https://security.gentoo.org/glsa/201509-03
More from Cacti
9.8
CVE-2022-46169
Unauthenticated Command Injection
9.8
CVE-2026-40079
Cacti: Command Injection via escape_command() no-op in RRDtool execution
9.8
CVE-2026-39948
Cacti has SQL Injection via rfilter parameter in RLIKE clauses
9.8
CVE-2026-39955
Cacti has Pre-Authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.php
9.8
CVE-2026-39938
Cacti: Unauthenticated RCE on Graph Image