CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 05/09/2023 |
| CVE-2022-48547 | 中危6.1 | A reflected cross-site scripting (XSS) vulnerability in Cacti 0.8.7g and earlier allows unauthenticated remote attackers to inject arbitrary web script or HTML in the "ref" parameter at auth_changepassword.php. | 22/08/2023 |
| CVE-2022-48538 | 中危5.3 | In Cacti 1.2.19, there is an authentication bypass in the web login functionality because of improper validation in the PHP code: cacti_ldap_auth() allows a zero as the password. | 22/08/2023 |
| CVE-2022-41444 | 中危6.1 | Cross Site Scripting (XSS) vulnerability in Cacti 1.2.21 via crafted POST request to graphs_new.php. | 22/08/2023 |
| CVE-2023-37543 | 高危7.5 | Cacti before 1.2.6 allows IDOR (Insecure Direct Object Reference) for accessing any graph via a modified local_graph_id parameter to graph_xport.php. This is a different vulnerability than CVE-2019-16723. | 10/08/2023 |
| CVE-2022-46169KEV | 严重9.8 | Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In affected versions a command injection vulnerability allows an unauthenticated user to execute arbitrary code on a server running Cacti, if a specific data source was selected for a | 05/12/2022 |
| CVE-2022-0730 | 严重9.8 | Under certain ldap conditions, Cacti authentication can be bypassed with certain credential types. | 03/03/2022 |
| CVE-2021-3816 | 中危5.4 | Cacti 1.1.38 allows authenticated users with User Management permissions to inject arbitrary HTML in the group_prefix field during the creation of a new group via "Copy" method at user_group_admin.php. | 19/01/2022 |
| CVE-2021-26247 | 中危6.1 | As an unauthenticated remote user, visit "http://<CACTI_SERVER>/auth_changepassword.php?ref=<script>alert(1)</script>" to successfully execute the JavaScript payload present in the "ref" URL parameter. | 19/01/2022 |
| CVE-2021-23225 | 中危5.4 | Cacti 1.1.38 allows authenticated users with User Management permissions to inject arbitrary web script or HTML in the "new_username" field during creation of a new user via "Copy" method at user_admin.php. | 19/01/2022 |
| CVE-2020-14424 | 中危6.1 | Cacti before 1.2.18 allows remote attackers to trigger XSS via template import for the midwinter theme. | 14/11/2021 |
| CVE-2020-23226 | 中危6.1 | Multiple Cross Site Scripting (XSS) vulneratiblities exist in Cacti 1.2.12 in (1) reports_admin.php, (2) data_queries.php, (3) data_input.php, (4) graph_templates.php, (5) graphs.php, (6) reports_admin.php, and (7) data_input.php. | 27/08/2021 |
| CVE-2020-35701 | 高危8.8 | An issue was discovered in Cacti 1.2.x through 1.2.16. A SQL injection vulnerability in data_debug.php allows remote authenticated attackers to execute arbitrary SQL commands via the site_id parameter. This can lead to remote code execution. | 11/01/2021 |
| CVE-2020-25706 | 中危6.1 | A cross-site scripting (XSS) vulnerability exists in templates_import.php (Cacti 1.2.13) due to Improper escaping of error message during template import preview in the xml_path field | 12/11/2020 |
| CVE-2020-14295 | 高危7.2 | A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries. | 17/06/2020 |
| CVE-2020-13231 | 中危6.5 | In Cacti before 1.2.11, auth_profile.php?action=edit allows CSRF for an admin email change. | 20/05/2020 |
| CVE-2020-13230 | 中危4.3 | In Cacti before 1.2.11, disabling a user account does not immediately invalidate any permissions granted to that account (e.g., permission to view logs). | 20/05/2020 |
| CVE-2020-8813 | 高危8.8 | graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege. | 22/02/2020 |