CVEs we hold for Cacti
Records whose assigning authority named Cacti as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-71287Cacti sanitize_sql_column() Regex Allowlist Permits SQL Time-Delay Functions Leading to Blind SQL Injectioncacti CVE-2026-40941Cacti: Package Import Signature Validation Bypass Allows Self-Signed Packagescacti CVE-2026-40084Cacti: Arbitrary File Read via Path Traversal in Report `format_file` Parametercacti CVE-2026-40082Cacti: Session Fixation via missing session_regenerate_id() after logincacti CVE-2026-40080Cacti: Open Redirect via HTTP_REFERER substring check in auth_login_redirectcacti CVE-2026-40079Cacti: Command Injection via escape_command() no-op in RRDtool executioncacti CVE-2026-39955Cacti has Pre-Authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.phpcacti CVE-2026-39951Cacti: Stored SQL Injection via graph_name_regexp in Reports featurecacti CVE-2026-39948Cacti has SQL Injection via rfilter parameter in RLIKE clausescacti CVE-2026-39900Cacti: Reflected XSS via tab parameter in auth_profile.php JavaScript contextcacti CVE-2026-39899Cacti: Path Traversal via filename parameter in package_import.phpcacti CVE-2026-39897Cacti has a Reflected XSS Vulnerability via html_auth_footercacti CVE-2026-39894Cacti: RRDtool metric shift via LC_NUMERIC locale comma decimal formattingcacti CVE-2026-39893Cacti: Pre-authentication SQL injection via rfilter RLIKE clause in graph_view.phpcacti CVE-2025-24368Cacti has a SQL Injection vulnerability when using tree rules through Automation APIcacti CVE-2025-24367Cacti allows Arbitrary File Creation leading to RCEcacti CVE-2025-22604Cacti has Authenticated RCE via multi-line SNMP responsescacti CVE-2024-54146Cacti has a SQL Injection vulnerability when view host templatecacti CVE-2024-54145Cacti has a SQL Injection vulnerability when request automation devicescacti CVE-2024-45598Cacti has a Local File Inclusion (LFI) Vulnerability via Poller Standard Error Log Pathcacti CVE-2024-43365Stored Cross-site Scripting (XSS) when creating external links in Cacticacti CVE-2024-43364Stored Cross-site Scripting (XSS) when creating external links in Cacticacti CVE-2024-43362Stored Cross-site Scripting (XSS) when creating external links in Cacticacti CVE-2024-34340Authentication Bypass when using using older password hashescacti CVE-2024-31460Cacti SQL Injection vulnerability in lib/api_automation.php caused by reading dirty data stored in databasecacti CVE-2024-31459Cacti RCE vulnerability by file include in lib/plugin.phpcacti CVE-2024-31458Cacti SQL Injection vulnerability in lib/html_form_templates.php by reading dirty data stored in databasecacti CVE-2024-31445SQL Injection vulnerability in automation_get_new_graphs_sqlcacti CVE-2024-31444Cacti XSS vulnerability in lib/html.php by reading dirty data stored in databasecacti CVE-2024-31443Cacti XSS vulnerability in lib/html_tree.php by reading dirty data stored in databasecacti CVE-2024-29894Cacti Cross-site Scripting vulnerability when using JavaScript based messaging APIcacti CVE-2024-27082Cacti Cross-site Scripting vulnerability when managing treescacti CVE-2023-51448SQL Injection vulnerability when managing SNMP Notification Receiverscacti CVE-2023-50250Cross-Site Scripting vulnerability when Import xml template filecacti CVE-2023-49086Cacti is vulnerable to cross-Site scripting (XSS) DOMcacti CVE-2023-39516Stored Cross-Site-Scripting on data_sources.php debug html-block in Cacticacti CVE-2023-39515Stored Cross-site Scripting on data_debug.php datasource path view in Cacticacti CVE-2023-39514Stored Cross-site Scripting on graphs.php data template formated name view in Cacticacti CVE-2023-39513Stored Cross-site Scripting on host.php verbose data-query debug view in Cacticacti CVE-2023-39512Stored Cross-site Scripting on data_sources.php device name view in Cacticacti CVE-2023-39511Stored Cross-Site-Scripting on reports_admin.php device name in Cacticacti CVE-2023-39510Stored Cross-site Scripting in reports_admin.php through Device-Name in 'select' input in Cacticacti CVE-2023-39366Stored Cross-site Scripting in data_sources.php through Device-Name in 'select' input in Cacticacti CVE-2023-39365Unchecked regular expressions can lead to SQL Injection and data leakage in Cacticacti CVE-2023-39364Open redirect in change password functionality in Cacticacti CVE-2023-39362Authenticated command injection in SNMP options of a Devicecacti CVE-2023-39361Unauthenticated SQL Injection in graph_view.php in Cacticacti CVE-2023-39360Reflected Cross-site Scripting in graphs_new.php in Cacticacti CVE-2023-39359Authenticated SQL injection vulnerability in graphs.php in Cacticacti CVE-2023-39358Authenticated SQL injection vulnerability in reports_user.php in Cacticacti CVE-2023-39357A Defect in sql_save() Causes Multiple SQL Injection Vulnerabilities in Cacticacti 68 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.