CVE-2014-5026

LOW 3.5CVE-2014-5026 · Published 20/10/2014 · updated 17/06/2026

In short

CVE-2014-5026 is a LOW (CVSS 3.5) vulnerability affecting cacti (cacti).
Chance of exploitation in the next 30 days (EPSS): 1.9%, higher than 79.8% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
cacti cacti	`= 0.8.8b`	No fix yet

Description

Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote authenticated users with console access to inject arbitrary web script or HTML via a (1) Graph Tree Title in a delete or (2) edit action; (3) CDEF Name, (4) Data Input Method Name, or (5) Host Templates Name in a delete action; (6) Data Source Title; (7) Graph Title; or (8) Graph Template Name in a delete or (9) duplicate action.

References

bugs.cacti.net/view.php · Issue Tracking
lists.opensuse.org/opensuse-updates/2015-03/msg00034.html · Third Party Advisory
seclists.org/oss-sec/2014/q3/244 · Exploit
debian.org/security/2014/dsa-3007 · Third Party Advisory
openwall.com/lists/oss-security/2014/07/22/9 · Exploit
securityfocus.com/bid/68759 · Third Party Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/94816
security.gentoo.org/glsa/201509-03

More vulnerabilities in cacti

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

cacti

= 0.8.8b

No fix yet

Description

More vulnerabilities in cacti

See all →