CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 05/09/2023 |
| CVE-2022-48547 | 보통6.1 | A reflected cross-site scripting (XSS) vulnerability in Cacti 0.8.7g and earlier allows unauthenticated remote attackers to inject arbitrary web script or HTML in the "ref" parameter at auth_changepassword.php. | 22/08/2023 |
| CVE-2022-48538 | 보통5.3 | In Cacti 1.2.19, there is an authentication bypass in the web login functionality because of improper validation in the PHP code: cacti_ldap_auth() allows a zero as the password. | 22/08/2023 |
| CVE-2022-41444 | 보통6.1 | Cross Site Scripting (XSS) vulnerability in Cacti 1.2.21 via crafted POST request to graphs_new.php. | 22/08/2023 |
| CVE-2023-37543 | 높음7.5 | Cacti before 1.2.6 allows IDOR (Insecure Direct Object Reference) for accessing any graph via a modified local_graph_id parameter to graph_xport.php. This is a different vulnerability than CVE-2019-16723. | 10/08/2023 |
| CVE-2022-46169KEV | 심각9.8 | Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In affected versions a command injection vulnerability allows an unauthenticated user to execute arbitrary code on a server running Cacti, if a specific data source was selected for a | 05/12/2022 |
| CVE-2022-0730 | 심각9.8 | Under certain ldap conditions, Cacti authentication can be bypassed with certain credential types. | 03/03/2022 |
| CVE-2021-3816 | 보통5.4 | Cacti 1.1.38 allows authenticated users with User Management permissions to inject arbitrary HTML in the group_prefix field during the creation of a new group via "Copy" method at user_group_admin.php. | 19/01/2022 |
| CVE-2021-26247 | 보통6.1 | As an unauthenticated remote user, visit "http://<CACTI_SERVER>/auth_changepassword.php?ref=<script>alert(1)</script>" to successfully execute the JavaScript payload present in the "ref" URL parameter. | 19/01/2022 |
| CVE-2021-23225 | 보통5.4 | Cacti 1.1.38 allows authenticated users with User Management permissions to inject arbitrary web script or HTML in the "new_username" field during creation of a new user via "Copy" method at user_admin.php. | 19/01/2022 |
| CVE-2020-14424 | 보통6.1 | Cacti before 1.2.18 allows remote attackers to trigger XSS via template import for the midwinter theme. | 14/11/2021 |
| CVE-2020-23226 | 보통6.1 | Multiple Cross Site Scripting (XSS) vulneratiblities exist in Cacti 1.2.12 in (1) reports_admin.php, (2) data_queries.php, (3) data_input.php, (4) graph_templates.php, (5) graphs.php, (6) reports_admin.php, and (7) data_input.php. | 27/08/2021 |
| CVE-2020-35701 | 높음8.8 | An issue was discovered in Cacti 1.2.x through 1.2.16. A SQL injection vulnerability in data_debug.php allows remote authenticated attackers to execute arbitrary SQL commands via the site_id parameter. This can lead to remote code execution. | 11/01/2021 |
| CVE-2020-25706 | 보통6.1 | A cross-site scripting (XSS) vulnerability exists in templates_import.php (Cacti 1.2.13) due to Improper escaping of error message during template import preview in the xml_path field | 12/11/2020 |
| CVE-2020-14295 | 높음7.2 | A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries. | 17/06/2020 |
| CVE-2020-13231 | 보통6.5 | In Cacti before 1.2.11, auth_profile.php?action=edit allows CSRF for an admin email change. | 20/05/2020 |
| CVE-2020-13230 | 보통4.3 | In Cacti before 1.2.11, disabling a user account does not immediately invalidate any permissions granted to that account (e.g., permission to view logs). | 20/05/2020 |
| CVE-2020-8813 | 높음8.8 | graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege. | 22/02/2020 |