CA
Product
cacti
On CISA KEVExploited in the wild
156
CVEs
1
On KEV
9.8
Max CVSS
3
New 30D
Severity mix
Critical 11High 43Medium 63Low 1
Watch
Add cacti to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-48538 | 5.3 | Aug 22 | In Cacti 1.2.19, there is an authentication bypass in the web login functionality because of improper validation in the PHP code: cacti_ldap_auth() allows a zero as the password Affected: 1.2.19 |
| CVE-2024-45598 | 4.9 | Jan 27 | Cacti is an open source performance and fault management framework Affected: before 1.2.29 |
| CVE-2017-16661 | 4.9 | Nov 8 | Cacti 1.1.27 allows remote authenticated administrators to read arbitrary files by placing the Log Path into a private directory, and then making a clog.php?filename= request, as… Affected: 1.1.27 |
| CVE-2023-49088 | 4.8 | Dec 22 | Cacti is an open source operational monitoring and fault management framework Affected: before 1.2.25 |
| CVE-2023-39511 | 4.8 | Sep 6 | Cacti is an open source operational monitoring and fault management framework Affected: before 1.2.25 |
| CVE-2023-39516 | 4.8 | Sep 5 | Cacti is an open source operational monitoring and fault management framework Affected: before 1.2.25 |
| CVE-2023-39515 | 4.8 | Sep 5 | Cacti is an open source operational monitoring and fault management framework Affected: before 1.2.25 |
| CVE-2023-39512 | 4.8 | Sep 5 | Cacti is an open source operational monitoring and fault management framework Affected: before 1.2.25 |
| CVE-2023-39510 | 4.8 | Sep 5 | Cacti is an open source operational monitoring and fault management framework Affected: before 1.2.25 |
| CVE-2023-39366 | 4.8 | Sep 5 | Cacti is an open source operational monitoring and fault management framework Affected: 1.2.0 before 1.2.25 |
| CVE-2018-20725 | 4.8 | Jan 16 | A cross-site scripting (XSS) vulnerability exists in graph_templates.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Graph Vertical Label Affected: before 1.2.0 |
| CVE-2018-20723 | 4.8 | Jan 16 | A cross-site scripting (XSS) vulnerability exists in color_templates.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Name field for a Color Affected: before 1.2.0 |
| CVE-2018-20724 | 4.8 | Jan 16 | A cross-site scripting (XSS) vulnerability exists in pollers.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname for Data Collectors Affected: before 1.2.0 |
| CVE-2024-29894 | 4.7 | May 14 | Cacti provides an operational monitoring and fault management framework Affected: before 1.2.27 |
| CVE-2023-30534 | 4.3 | Sep 5 | Cacti is an open source operational monitoring and fault management framework Affected: before 1.2.25 |
| CVE-2020-13230 | 4.3 | May 20 | In Cacti before 1.2.11, disabling a user account does not immediately invalidate any permissions granted to that account (e.g., permission to view logs) Affected: before 1.2.11 |
| CVE-2019-16723 | 4.3 | Sep 23 | In Cacti through 1.2.6, authenticated users may bypass authorization checks (for viewing a graph) via a direct graph_json.php request with a modified local_graph_id parameter Affected: through 1.2.6 |
| CVE-2026-39894 | 2.5 | Jun 24 | Cacti: RRDtool metric shift via LC_NUMERIC locale comma decimal formatting Affected: < 1.2.31 |
| CVE-2015-8369 | – | Dec 17 | SQL injection vulnerability in include/top_graph_header.php in Cacti 0.8.8f and earlier allows remote attackers to execute arbitrary SQL commands via the rra_id parameter in a… Affected: through 0.8.8f |
| CVE-2015-8377 | – | Dec 15 | SQL injection vulnerability in the host_new_graphs_save function in graphs_new.php in Cacti 0.8.8f and earlier allows remote authenticated users to execute arbitrary SQL commands… Affected: through 0.8.8f |
| CVE-2015-4634 | – | Aug 11 | SQL injection vulnerability in graphs.php in Cacti before 0.8.8e allows remote attackers to execute arbitrary SQL commands via the local_graph_id parameter Affected: through 0.8.8d |
| CVE-2015-2967 | – | Jul 10 | Cross-site scripting (XSS) vulnerability in settings.php in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: through 0.8.8c |
| CVE-2015-4454 | – | Jun 17 | SQL injection vulnerability in the get_hash_graph_template function in lib/functions.php in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via the… Affected: through 0.8.8c |
| CVE-2015-4342 | – | Jun 17 | SQL injection vulnerability in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via unspecified vectors involving a cdef id Affected: through 0.8.8c |
| CVE-2015-2665 | – | Jun 17 | Cross-site scripting (XSS) vulnerability in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: through 0.8.8c |
| CVE-2015-0916 | – | May 22 | SQL injection vulnerability in graph.php in Cacti before 0.8.6f allows remote authenticated users to execute arbitrary SQL commands via the local_graph_id parameter, a different… Affected: through 0.8.6e |
| CVE-2014-5026 | – | Oct 20 | Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote authenticated users with console access to inject arbitrary web script or HTML via a (1) Graph… Affected: 0.8.8b |
| CVE-2014-5025 | – | Oct 20 | Cross-site scripting (XSS) vulnerability in data_sources.php in Cacti 0.8.8b allows remote authenticated users with console access to inject arbitrary web script or HTML via the… Affected: 0.8.8b |
| CVE-2014-5262 | – | Aug 22 | SQL injection vulnerability in the graph settings script (graph_settings.php) in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary SQL commands via unspecified… Affected: through 0.8.8b; 0.8.6e; 0.8.7; 0.8.7a; 0.8.7b; 0.8.7c; +7 more |
| CVE-2014-5261 | – | Aug 22 | The graph settings script (graph_settings.php) in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a font size, related… Affected: through 0.8.8b; 0.8.6e; 0.8.7; 0.8.7a; 0.8.7b; 0.8.7c; +7 more |
| CVE-2014-4002 | – | Jul 3 | Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote attackers to inject arbitrary web script or HTML via the (1) drp_action parameter to cdef.php, (2)… Affected: 0.8.8b |
| CVE-2014-2709 | – | Apr 23 | lib/rrd.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified parameters Affected: 0.8.7 through 0.8.7g; 0.8.8 through 0.8.8b |
| CVE-2014-2328 | – | Apr 23 | lib/graph_export.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote authenticated users to execute arbitrary commands via shell metacharacters in unspecified vectors Affected: 0.8.7 through 0.8.7g; 0.8.8 through 0.8.8b |
| CVE-2014-2327 | – | Apr 23 | Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as… Affected: 0.8.7 through 0.8.7g; 0.8.8 through 0.8.8b |
| CVE-2014-2708 | – | Apr 10 | Multiple SQL injection vulnerabilities in graph_xport.php in Cacti 0.8.7g, 0.8.8b, and earlier allow remote attackers to execute arbitrary SQL commands via the (1) graph_start,… Affected: 0.8.8b |
| CVE-2014-2326 | – | Mar 27 | Cross-site scripting (XSS) vulnerability in cdef.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: 0.8.7g |
| CVE-2013-5589 | – | Aug 29 | SQL injection vulnerability in cacti/host.php in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter Affected: through 0.8.8b; 0.8; 0.8.1; 0.8.2; 0.8.2a; 0.8.3; +28 more |
| CVE-2013-5588 | – | Aug 29 | Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.8b and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the step parameter to… Affected: through 0.8.8b; 0.8; 0.8.1; 0.8.2; 0.8.2a; 0.8.3; +28 more |
| CVE-2013-1435 | – | Aug 23 | (1) snmp.php and (2) rrd.php in Cacti before 0.8.8b allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors Affected: 0.8; 0.8.1; 0.8.2; 0.8.2a; 0.8.3; 0.8.3a; +27 more |
| CVE-2013-1434 | – | Aug 23 | Multiple SQL injection vulnerabilities in (1) api_poller.php and (2) utility.php in Cacti before 0.8.8b allow remote attackers to execute arbitrary SQL commands via unspecified… Affected: through 0.8.8a; 0.8.5; 0.8.5a; 0.8.6; 0.8.6a; 0.8.6b; +17 more |
| CVE-2011-5223 | – | Oct 25 | Cross-site request forgery (CSRF) vulnerability in logout.php in Cacti before 0.8.7i allows remote attackers to hijack the authentication of unspecified victims via unknown… Affected: through 0.8.7h; 0.5; 0.6; 0.6.1; 0.6.2; 0.6.3; +33 more |
| CVE-2011-4824 | – | Dec 15 | SQL injection vulnerability in auth_login.php in Cacti before 0.8.7h allows remote attackers to execute arbitrary SQL commands via the login_username parameter Affected: through 0.8.7g; 0.5; 0.6; 0.6.1; 0.6.2; 0.6.3; +32 more |
| CVE-2010-2545 | – | Aug 23 | Multiple cross-site scripting (XSS) vulnerabilities in Cacti before 0.8.7g, as used in Red Hat High Performance Computing (HPC) Solution and other products, allow remote attackers… Affected: through 0.8.7f; 0.5; 0.6; 0.6.1; 0.6.2; 0.6.3; +32 more |
| CVE-2010-2544 | – | Aug 23 | Cross-site scripting (XSS) vulnerability in utilities.php in Cacti before 0.8.7g, as used in Red Hat High Performance Computing (HPC) Solution and other products, allows remote… Affected: through 0.8.7f; 0.5; 0.6; 0.6.1; 0.6.2; 0.6.3; +32 more |
| CVE-2010-2543 | – | Aug 23 | Cross-site scripting (XSS) vulnerability in include/top_graph_header.php in Cacti before 0.8.7g allows remote attackers to inject arbitrary web script or HTML via the graph_start… Affected: through 0.8.7f; 0.5; 0.6; 0.6.1; 0.6.2; 0.6.3; +32 more |
| CVE-2010-1645 | – | Aug 23 | Cacti before 0.8.7f, as used in Red Hat High Performance Computing (HPC) Solution and other products, allows remote authenticated administrators to execute arbitrary commands via… Affected: through 0.8.7e; 0.5; 0.6; 0.6.1; 0.6.2; 0.6.3; +31 more |
| CVE-2010-1644 | – | Aug 23 | Multiple cross-site scripting (XSS) vulnerabilities in Cacti before 0.8.7f, as used in Red Hat High Performance Computing (HPC) Solution and other products, allow remote attackers… Affected: through 0.8.7e; 0.5; 0.6; 0.6.1; 0.6.2; 0.6.3; +31 more |
| CVE-2010-2092 | – | May 27 | SQL injection vulnerability in graph.php in Cacti 0.8.7e and earlier allows remote attackers to execute arbitrary SQL commands via a crafted rra_id parameter in a GET request in… Affected: through 0.8.7e; 0.5; 0.6; 0.6.1; 0.6.2; 0.6.3; +31 more |
| CVE-2010-1431 | – | May 4 | SQL injection vulnerability in templates_export.php in Cacti 0.8.7e and earlier allows remote attackers to execute arbitrary SQL commands via the export_item_id parameter Affected: through 0.8.7e; 0.5; 0.6; 0.6.1; 0.6.2; 0.6.3; +31 more |
| CVE-2009-4112 | – | Nov 30 | Cacti 0.8.7e and earlier allows remote authenticated administrators to gain privileges by modifying the "Data Input Method" for the "Linux - Get Memory Usage" setting to contain… Affected: through 0.8.7e; 0.6.7; 0.8; 0.8.1; 0.8.2; 0.8.2a; +10 more |