| CVE-2017-15194 | 中6.1 | include/global_session.php in Cacti 1.1.25 has XSS related to (1) the URI or (2) the refresh page. | 11/10/2017 |
| CVE-2017-12978 | 中5.4 | lib/html.php in Cacti before 1.1.18 has XSS via the title field of an external link added by an authenticated user. | 21/08/2017 |
| CVE-2017-12927 | 中6.1 | A cross-site scripting vulnerability exists in Cacti 1.1.17 in the method parameter in spikekill.php. | 18/08/2017 |
| CVE-2017-12066 | 中5.4 | Cross-site scripting (XSS) vulnerability in aggregate_graphs.php in Cacti before 1.1.16 allows remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers, related to the $cancel_url variable. NOTE: this vulnerability exists because of an incomplete fix (lack of the html | 01/08/2017 |
| CVE-2017-12065 | 緊急9.8 | spikekill.php in Cacti before 1.1.16 might allow remote attackers to execute arbitrary code via the avgnan, outlier-start, or outlier-end parameter. | 01/08/2017 |
| CVE-2017-11691 | 中5.4 | Cross-site scripting (XSS) vulnerability in auth_profile.php in Cacti 1.1.13 allows remote attackers to inject arbitrary web script or HTML via specially crafted HTTP Referer headers. | 27/07/2017 |
| CVE-2017-1000032 | 中6.1 | Cross-Site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote attackers to inject arbitrary web script or HTML via the parent_id parameter to tree.php and drp_action parameter to data_sources.php. | 17/07/2017 |
| CVE-2017-1000031 | 高8.8 | SQL injection vulnerability in graph_templates_inputs.php in Cacti 0.8.8b allows remote attackers to execute arbitrary SQL commands via the graph_template_input_id and graph_template_id parameters. | 17/07/2017 |
| CVE-2017-11163 | 中5.4 | Cross-site scripting (XSS) vulnerability in aggregate_graphs.php in Cacti 1.1.12 allows remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers, related to the $cancel_url variable. | 10/07/2017 |
| CVE-2017-10970 | 中5.4 | Cross-site scripting (XSS) vulnerability in link.php in Cacti 1.1.12 allows remote anonymous users to inject arbitrary web script or HTML via the id parameter, related to the die_html_input_error function in lib/html_validate.php. | 06/07/2017 |
| CVE-2016-2313 | 高8.8 | auth_login.php in Cacti before 0.8.8g allows remote authenticated users who use web authentication to bypass intended access restrictions by logging in as a user not in the cacti database. | 13/04/2016 |
| CVE-2016-3172 | 高8.8 | SQL injection vulnerability in tree.php in Cacti 0.8.8g and earlier allows remote authenticated users to execute arbitrary SQL commands via the parent_id parameter in an item_edit action. | 12/04/2016 |
| CVE-2015-8604 | 高8.8 | SQL injection vulnerability in the host_new_graphs function in graphs_new.php in Cacti 0.8.8f and earlier allows remote authenticated users to execute arbitrary SQL commands via the cg_g parameter in a save action. | 11/04/2016 |
| CVE-2016-3659 | 高8.8 | SQL injection vulnerability in graph_view.php in Cacti 0.8.8.g allows remote authenticated users to execute arbitrary SQL commands via the host_group_data parameter. | 11/04/2016 |
| CVE-2015-8369 | 高7.5 | SQL injection vulnerability in include/top_graph_header.php in Cacti 0.8.8f and earlier allows remote attackers to execute arbitrary SQL commands via the rra_id parameter in a properties action to graph.php. | 17/12/2015 |
| CVE-2015-8377 | 中6.5 | SQL injection vulnerability in the host_new_graphs_save function in graphs_new.php in Cacti 0.8.8f and earlier allows remote authenticated users to execute arbitrary SQL commands via crafted serialized data in the selected_graphs_array parameter in a save action. | 15/12/2015 |
| CVE-2015-4634 | 高7.5 | SQL injection vulnerability in graphs.php in Cacti before 0.8.8e allows remote attackers to execute arbitrary SQL commands via the local_graph_id parameter. | 11/08/2015 |
| CVE-2015-2967 | 中4.3 | Cross-site scripting (XSS) vulnerability in settings.php in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | 10/07/2015 |
| CVE-2015-4454 | 高7.5 | SQL injection vulnerability in the get_hash_graph_template function in lib/functions.php in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via the graph_template_id parameter to graph_templates.php. | 17/06/2015 |
| CVE-2015-4342 | 高7.5 | SQL injection vulnerability in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via unspecified vectors involving a cdef id. | 17/06/2015 |