CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 05/09/2023 |
| CVE-2022-48547 | MÉDIO6.1 | A reflected cross-site scripting (XSS) vulnerability in Cacti 0.8.7g and earlier allows unauthenticated remote attackers to inject arbitrary web script or HTML in the "ref" parameter at auth_changepassword.php. | 22/08/2023 |
| CVE-2022-48538 | MÉDIO5.3 | In Cacti 1.2.19, there is an authentication bypass in the web login functionality because of improper validation in the PHP code: cacti_ldap_auth() allows a zero as the password. | 22/08/2023 |
| CVE-2022-41444 | MÉDIO6.1 | Cross Site Scripting (XSS) vulnerability in Cacti 1.2.21 via crafted POST request to graphs_new.php. | 22/08/2023 |
| CVE-2023-37543 | ALTO7.5 | Cacti before 1.2.6 allows IDOR (Insecure Direct Object Reference) for accessing any graph via a modified local_graph_id parameter to graph_xport.php. This is a different vulnerability than CVE-2019-16723. | 10/08/2023 |
| CVE-2022-46169KEV | CRÍTICO9.8 | Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In affected versions a command injection vulnerability allows an unauthenticated user to execute arbitrary code on a server running Cacti, if a specific data source was selected for a | 05/12/2022 |
| CVE-2022-0730 | CRÍTICO9.8 | Under certain ldap conditions, Cacti authentication can be bypassed with certain credential types. | 03/03/2022 |
| CVE-2021-3816 | MÉDIO5.4 | Cacti 1.1.38 allows authenticated users with User Management permissions to inject arbitrary HTML in the group_prefix field during the creation of a new group via "Copy" method at user_group_admin.php. | 19/01/2022 |
| CVE-2021-26247 | MÉDIO6.1 | As an unauthenticated remote user, visit "http://<CACTI_SERVER>/auth_changepassword.php?ref=<script>alert(1)</script>" to successfully execute the JavaScript payload present in the "ref" URL parameter. | 19/01/2022 |
| CVE-2021-23225 | MÉDIO5.4 | Cacti 1.1.38 allows authenticated users with User Management permissions to inject arbitrary web script or HTML in the "new_username" field during creation of a new user via "Copy" method at user_admin.php. | 19/01/2022 |
| CVE-2020-14424 | MÉDIO6.1 | Cacti before 1.2.18 allows remote attackers to trigger XSS via template import for the midwinter theme. | 14/11/2021 |
| CVE-2020-23226 | MÉDIO6.1 | Multiple Cross Site Scripting (XSS) vulneratiblities exist in Cacti 1.2.12 in (1) reports_admin.php, (2) data_queries.php, (3) data_input.php, (4) graph_templates.php, (5) graphs.php, (6) reports_admin.php, and (7) data_input.php. | 27/08/2021 |
| CVE-2020-35701 | ALTO8.8 | An issue was discovered in Cacti 1.2.x through 1.2.16. A SQL injection vulnerability in data_debug.php allows remote authenticated attackers to execute arbitrary SQL commands via the site_id parameter. This can lead to remote code execution. | 11/01/2021 |
| CVE-2020-25706 | MÉDIO6.1 | A cross-site scripting (XSS) vulnerability exists in templates_import.php (Cacti 1.2.13) due to Improper escaping of error message during template import preview in the xml_path field | 12/11/2020 |
| CVE-2020-14295 | ALTO7.2 | A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries. | 17/06/2020 |
| CVE-2020-13231 | MÉDIO6.5 | In Cacti before 1.2.11, auth_profile.php?action=edit allows CSRF for an admin email change. | 20/05/2020 |
| CVE-2020-13230 | MÉDIO4.3 | In Cacti before 1.2.11, disabling a user account does not immediately invalidate any permissions granted to that account (e.g., permission to view logs). | 20/05/2020 |
| CVE-2020-8813 | ALTO8.8 | graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege. | 22/02/2020 |