Vulnerabilidades em Cacti

65 resultados
Análise Vexday

O Cacti apresenta uma taxa de exploração ativa 3,7 vezes acima da média geral do catálogo CISA KEV, o que indica risco operacional elevado apesar do volume absoluto de 60 CVEs catalogadas. O destaque mais crítico é o CVE-2022-46169, com escore EPSS de 0,9983 — valor próximo ao máximo possível —, confirmado em exploração ativa e sinalizando probabilidade muito alta de uso por agentes maliciosos. Das 60 vulnerabilidades conhecidas, 10 são de severidade crítica e 7 possuem PoC pública, o que amplia a superfície de ataque disponível para qualquer agente com capacidade técnica limitada. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), e o surgimento de 11 novas CVEs nos últimos 90 dias indica que a superfície de ataque segue em expansão, exigindo atenção prioritária na aplicação de correções e no monitoramento contínuo de instâncias expostas.

CVE-2023-30534MEDIUMInsecure Deserialization in CactiEPSS 2.9%CVE-2024-31459HIGHCacti RCE vulnerability by file include in lib/plugin.phpEPSS 2.7%CVE-2023-39359HIGHAuthenticated SQL injection vulnerability in graphs.php in CactiEPSS 2.1%CVE-2023-39358HIGHAuthenticated SQL injection vulnerability in reports_user.php in CactiEPSS 2.0%CVE-2023-39357HIGHA Defect in sql_save() Causes Multiple SQL Injection Vulnerabilities in CactiEPSS 1.8%CVE-2024-31460MEDIUMCacti SQL Injection vulnerability in lib/api_automation.php caused by reading dirty data stored in databaseEPSS 1.8%CVE-2026-40079HIGHCacti: Command Injection via escape_command() no-op in RRDtool executionEPSS 1.7%CVE-2023-49086MEDIUMCacti is vulnerable to cross-Site scripting (XSS) DOMEPSS 1.5%CVE-2023-50250MEDIUMCross-Site Scripting vulnerability when Import xml template fileEPSS 1.3%CVE-2023-49088MEDIUMCacti has incomplete fix for CVE-2023-39515EPSS 1.3%CVE-2024-34340CRITICALAuthentication Bypass when using using older password hashesEPSS 1.1%CVE-2024-27082HIGHCacti Cross-site Scripting vulnerability when managing treesEPSS 0.9%CVE-2023-39513MEDIUMStored Cross-site Scripting on host.php verbose data-query debug view in CactiEPSS 0.9%CVE-2024-29894MEDIUMCacti Cross-site Scripting vulnerability when using JavaScript based messaging APIEPSS 0.9%CVE-2023-39360MEDIUMReflected Cross-site Scripting in graphs_new.php in CactiEPSS 0.9%CVE-2023-39366MEDIUMStored Cross-site Scripting in data_sources.php through Device-Name in 'select' input in CactiEPSS 0.9%CVE-2023-39514MEDIUMStored Cross-site Scripting on graphs.php data template formated name view in CactiEPSS 0.9%CVE-2023-39365MEDIUMUnchecked regular expressions can lead to SQL Injection and data leakage in CactiEPSS 0.9%CVE-2026-39948CRITICALCacti has SQL Injection via rfilter parameter in RLIKE clausesEPSS 0.8%CVE-2023-39516MEDIUMStored Cross-Site-Scripting on data_sources.php debug html-block in CactiEPSS 0.8%