CA
Product
cacti
On CISA KEVExploited in the wild
156
CVEs
1
On KEV
9.8
Max CVSS
3
New 30D
Severity mix
Critical 11High 43Medium 63Low 1
Watch
Add cacti to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-39511 | 4.8 | Sep 6 | Cacti is an open source operational monitoring and fault management framework Affected: before 1.2.25 |
| CVE-2023-39516 | 4.8 | Sep 5 | Cacti is an open source operational monitoring and fault management framework Affected: before 1.2.25 |
| CVE-2023-39515 | 4.8 | Sep 5 | Cacti is an open source operational monitoring and fault management framework Affected: before 1.2.25 |
| CVE-2023-39512 | 4.8 | Sep 5 | Cacti is an open source operational monitoring and fault management framework Affected: before 1.2.25 |
| CVE-2023-39510 | 4.8 | Sep 5 | Cacti is an open source operational monitoring and fault management framework Affected: before 1.2.25 |
| CVE-2023-39366 | 4.8 | Sep 5 | Cacti is an open source operational monitoring and fault management framework Affected: 1.2.0 before 1.2.25 |
| CVE-2018-20725 | 4.8 | Jan 16 | A cross-site scripting (XSS) vulnerability exists in graph_templates.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Graph Vertical Label Affected: before 1.2.0 |
| CVE-2018-20723 | 4.8 | Jan 16 | A cross-site scripting (XSS) vulnerability exists in color_templates.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Name field for a Color Affected: before 1.2.0 |
| CVE-2018-20724 | 4.8 | Jan 16 | A cross-site scripting (XSS) vulnerability exists in pollers.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname for Data Collectors Affected: before 1.2.0 |
| CVE-2024-29894 | 4.7 | May 14 | Cacti provides an operational monitoring and fault management framework Affected: before 1.2.27 |
| CVE-2023-30534 | 4.3 | Sep 5 | Cacti is an open source operational monitoring and fault management framework Affected: before 1.2.25 |
| CVE-2020-13230 | 4.3 | May 20 | In Cacti before 1.2.11, disabling a user account does not immediately invalidate any permissions granted to that account (e.g., permission to view logs) Affected: before 1.2.11 |
| CVE-2019-16723 | 4.3 | Sep 23 | In Cacti through 1.2.6, authenticated users may bypass authorization checks (for viewing a graph) via a direct graph_json.php request with a modified local_graph_id parameter Affected: through 1.2.6 |