cacti.

Cacti: User Enumeration via Error Messages

• cacti
• CWE-204

Cacti: Authenticated RCE on Data Input

• cacti
• Command injection

Cacti: Authenticated Stored 2nd-Order SQL Injection in automation_tree_rule_items.field (incomplete-fix variant of CVE-2024-31460 / CVE-2025-24368)

• cacti
• SQL injection

Cacti sanitize_sql_column() Regex Allowlist Permits SQL Time-Delay Functions Leading to Blind SQL Injection

• cacti
• SQL injection

Cacti: Package Import Signature Validation Bypass Allows Self-Signed Packages

• cacti
• Weak cryptography or TLS

Cacti: Arbitrary File Read via Path Traversal in Report `format_file` Parameter

• cacti
• Path traversal

Cacti: SQL Injection in managers.php

• cacti
• SQL injection

Cacti: Session Fixation via missing session_regenerate_id() after login

• cacti
• Authentication bypass

Cacti: Open Redirect via HTTP_REFERER substring check in auth_login_redirect

• cacti
• Open redirect

Cacti: Command Injection via escape_command() no-op in RRDtool execution

• cacti
• Command injection

Cacti: Stored SQL Injection via graph_name_regexp in Reports feature

• cacti
• SQL injection

Cacti has SQL Injection via rfilter parameter in RLIKE clauses

• cacti
• SQL injection

Cacti has Pre-Authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.php

• cacti
• SQL injection

Cacti: Unauthenticated RCE on Graph Image

• cacti
• Path traversal
• Command injection

Cacti: Reflected XSS via tab parameter in auth_profile.php JavaScript context

• cacti
• Cross-site scripting (XSS)

Cacti: Path Traversal via filename parameter in package_import.php

• cacti
• Path traversal

Cacti has a Reflected XSS Vulnerability via html_auth_footer

• cacti
• Cross-site scripting (XSS)

Cacti: RRDtool metric shift via LC_NUMERIC locale comma decimal formatting

• cacti
• CWE-474

Cacti: Pre-authentication SQL injection via rfilter RLIKE clause in graph_view.php

• cacti
• SQL injection

SNMP Command Injection leads to RCE in Cacti

• cacti
• Command injection

SQL injection in Cacti

• Cacti
• SQL injection

Cacti has a SQL Injection vulnerability when using tree rules through Automation API

• cacti
• SQL injection

Cacti allows Arbitrary File Creation leading to RCE

• cacti
• CWE-144

Cacti has Authenticated RCE via multi-line SNMP responses

• cacti
• Command injection

Cacti has a SQL Injection vulnerability when request automation devices

• cacti
• SQL injection

Cacti has a SQL Injection vulnerability when view host template

• cacti
• SQL injection

Cacti has a Local File Inclusion (LFI) Vulnerability via Poller Standard Error Log Path

• cacti
• Path traversal

Remote code execution via Log Poisoning in Cacti

• cacti
• Code injection

Stored Cross-site Scripting (XSS) when creating external links in Cacti

• cacti
• Cross-site scripting (XSS)

Stored Cross-site Scripting (XSS) when creating external links in Cacti

• cacti
• Cross-site scripting (XSS)

Stored Cross-site Scripting (XSS) when creating external links in Cacti

• cacti
• Cross-site scripting (XSS)

Authentication Bypass when using using older password hashes

• cacti
• Authentication bypass
• CWE-697

Cacti SQL Injection vulnerability in lib/api_automation.php caused by reading dirty data stored in database

• cacti
• SQL injection

Cacti RCE vulnerability by file include in lib/plugin.php

• cacti
• File inclusion

Cacti SQL Injection vulnerability in lib/html_form_templates.php by reading dirty data stored in database

• cacti
• SQL injection

SQL Injection vulnerability in automation_get_new_graphs_sql

• cacti
• SQL injection

Cacti XSS vulnerability in lib/html.php by reading dirty data stored in database

• cacti
• Cross-site scripting (XSS)

Cacti XSS vulnerability in lib/html_tree.php by reading dirty data stored in database

• cacti
• Cross-site scripting (XSS)

Cacti XSS vulnerability in display_settings

• cacti
• Cross-site scripting (XSS)

Cacti command injection in cmd_realtime.php

• cacti
• Command injection

Cacti Cross-site Scripting vulnerability when using JavaScript based messaging API

• cacti
• Cross-site scripting (XSS)
• CWE-116

Cacti Cross-site Scripting vulnerability when managing trees

• cacti
• Cross-site scripting (XSS)

Cacti RCE vulnerability when importing packages

• cacti
• CWE-20

SQL Injection vulnerability when managing SNMP Notification Receivers

• cacti
• SQL injection

Cross-Site Scripting vulnerability when Import xml template file

• cacti
• Cross-site scripting (XSS)

Cacti has incomplete fix for CVE-2023-39515

• cacti
• Cross-site scripting (XSS)

Cacti SQL Injection vulnerability

• cacti
• SQL injection

Cacti is vulnerable to cross-Site scripting (XSS) DOM

• cacti
• Cross-site scripting (XSS)

Local File Inclusion (RCE) in Cacti

• cacti
• File inclusion

Stored Cross-Site-Scripting on reports_admin.php device name in Cacti

• cacti
• Cross-site scripting (XSS)

Insecure Deserialization in Cacti

• cacti
• Insecure deserialization

Cacti Privilege Escalation

• cacti
• Authentication bypass

Authenticated command injection in SNMP options of a Device

• cacti
• Command injection

Open redirect in change password functionality in Cacti

• cacti
• Open redirect

Stored Cross-Site-Scripting on data_sources.php debug html-block in Cacti

• cacti
• Cross-site scripting (XSS)

Unchecked regular expressions can lead to SQL Injection and data leakage in Cacti

• cacti
• SQL injection

A Defect in sql_save() Causes Multiple SQL Injection Vulnerabilities in Cacti

• cacti
• SQL injection
• CWE-20

Authenticated SQL injection vulnerability in reports_user.php in Cacti

• cacti
• SQL injection

Authenticated SQL injection vulnerability in graphs.php in Cacti

• cacti
• SQL injection

Unauthenticated SQL Injection in graph_view.php in Cacti

• cacti
• SQL injection