Vulnerabilities in Cacti
68 resultsCVE-2023-39515MEDIUMStored Cross-site Scripting on data_debug.php datasource path view in CactiEPSS 0.8%CVE-2024-31443MEDIUMCacti XSS vulnerability in lib/html_tree.php by reading dirty data stored in databaseEPSS 0.8%CVE-2023-39510MEDIUMStored Cross-site Scripting in reports_admin.php through Device-Name in 'select' input in CactiEPSS 0.8%CVE-2023-39512MEDIUMStored Cross-site Scripting on data_sources.php device name view in CactiEPSS 0.8%CVE-2023-39511MEDIUMStored Cross-Site-Scripting on reports_admin.php device name in CactiEPSS 0.8%CVE-2023-39364LOWOpen redirect in change password functionality in CactiEPSS 0.7%CVE-2026-39938CRITICALCacti: Unauthenticated RCE on Graph ImageEPSS 0.7%CVE-2026-39893CRITICALCacti: Pre-authentication SQL injection via rfilter RLIKE clause in graph_view.phpEPSS 0.7%CVE-2024-54145MEDIUMCacti has a SQL Injection vulnerability when request automation devicesEPSS 0.7%CVE-2024-30268MEDIUMCacti XSS vulnerability in display_settingsEPSS 0.6%CVE-2026-39955CRITICALCacti has Pre-Authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.phpEPSS 0.6%CVE-2026-71287HIGHCacti sanitize_sql_column() Regex Allowlist Permits SQL Time-Delay Functions Leading to Blind SQL InjectionEPSS 0.5%CVE-2025-24368MEDIUMCacti has a SQL Injection vulnerability when using tree rules through Automation APIEPSS 0.5%CVE-2026-40083HIGHCacti: SQL Injection in managers.phpEPSS 0.5%CVE-2026-40084MEDIUMCacti: Arbitrary File Read via Path Traversal in Report `format_file` ParameterEPSS 0.5%CVE-2025-26520HIGHCacti through 1.2.29 allows SQL injection in the template function in host_templates.php via the graph_template parameter. NOTE: this issue EPSS 0.5%CVE-2023-31132HIGHCacti Privilege EscalationEPSS 0.4%CVE-2026-39902HIGHCacti: Authenticated RCE on Data InputEPSS 0.4%CVE-2026-39951HIGHCacti: Stored SQL Injection via graph_name_regexp in Reports featureEPSS 0.4%CVE-2026-39899MEDIUMCacti: Path Traversal via filename parameter in package_import.phpEPSS 0.4%