Cacti

Records159All Threatist records

Exploited (KEV)1In CISA KEV

CVSS critical14CVSS 9.0–10.0

CVSS high61CVSS 7.0–8.9

Exploited now

Cacti records in CISA KEV

TI-2022-22813 Cacti Command Injection Vulnerability CRITICAL 100KEV 2023-02-16

Components

Products in the NVD configurations · select one to filter the records

Cacti 152 records CRITICAL Superlinks 1 record LOW

Records

152 records in Cacti · all components

TI-2022-22813 CVE-2022-46169

Unauthenticated command injection in cacti

CRITICAL 100KEV

Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99826 Published 2022-12-05 Fixed in 1.2.23 CWE-74

TI-2023-20500 CVE-2023-39361

Unauthenticated SQL Injection in graph_view.php in Cacti

HIGH 84

Cacti is an open source operational monitoring and fault management framework.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.88793 Published 2023-09-05 Fixed in 1.2.25 CWE-89

TI-2024-16869 CVE-2024-25641

Cacti RCE vulnerability when importing packages

HIGH 83

Cacti provides an operational monitoring and fault management framework.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.86303 Published 2024-05-13 Fixed in 1.2.27 CWE-20

TI-2024-20809 CVE-2024-31445

SQL Injection vulnerability in automation_get_new_graphs_sql

HIGH 79

Cacti provides an operational monitoring and fault management framework.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.26154 Published 2024-05-13 Fixed in 1.2.27 CWE-89

TI-2023-26750 CVE-2023-49085

Cacti SQL Injection vulnerability

HIGH 79

Cacti provides an operational monitoring and fault management framework.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.74451 Published 2023-12-22 No fix listed CWE-89

TI-2025-18110 CVE-2025-24367

Cacti allows Arbitrary File Creation leading to RCE

HIGH 78

Cacti is an open source performance and fault management framework.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.58848 Published 2025-01-27 No fix listed CWE-144

TI-2023-26749 CVE-2023-49084

Local File Inclusion (RCE) in Cacti

HIGH 76

Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.64448 Published 2023-12-21 No fix listed CWE-98

TI-2020-07071 CVE-2020-8813 · GHSA-gg99-fwr4-rcj9

graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS…

HIGH 76

graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.73957 Published 2020-02-22 No fix listed CWE-78

TI-2023-28102 CVE-2023-51448

SQL Injection vulnerability when managing SNMP Notification Receivers

HIGH 75

Cacti provides an operational monitoring and fault management framework.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.67338 Published 2023-12-22 No fix listed CWE-89

TI-2023-20501 CVE-2023-39362

Authenticated command injection in SNMP options of a Device

HIGH 75

Cacti is an open source operational monitoring and fault management framework.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.85449 Published 2023-09-05 Fixed in 1.2.25 CWE-78

TI-2025-40836 CVE-2025-66399

SNMP Command Injection leads to RCE in Cacti

HIGH 74

Cacti is an open source performance and fault management framework.

CVSS 4.0HIGH 7.4 Network Low privileges No interaction EPSS 0.1085 Published 2025-12-02 Fixed in 1.2.29 CWE-77

TI-2025-16490 CVE-2025-22604

Cacti has Authenticated RCE via multi-line SNMP responses

HIGH 74

Cacti is an open source performance and fault management framework.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.05302 Published 2025-01-27 No fix listed CWE-78

TI-2023-20498 CVE-2023-39359

Authenticated SQL injection vulnerability in graphs.php in Cacti

HIGH 73

Cacti is an open source operational monitoring and fault management framework.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02061 Published 2023-09-05 Fixed in 1.2.25 CWE-89

TI-2023-20497 CVE-2023-39358

Authenticated SQL injection vulnerability in reports_user.php in Cacti

HIGH 73

Cacti is an open source operational monitoring and fault management framework.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02044 Published 2023-09-05 Fixed in 1.2.25 CWE-89

TI-2020-11166 CVE-2020-14295 · GHSA-rwpv-9gq4-x5g3

A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the…

HIGH 73

A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.86062 Published 2020-06-17 No fix listed CWE-89

TI-2020-05697 CVE-2020-7058 · GHSA-446h-xh8r-vwqx

data_input.php in Cacti 1.2.8 allows remote code execution via a crafted Input String to…

HIGH 73

data_input.php in Cacti 1.2.8 allows remote code execution via a crafted Input String to Data Collection -> Data Input Methods -> Unix -> Ping Host.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02346 Published 2020-01-15 No fix listed CWE-20

TI-2005-04627 CVE-2005-10004 · GHSA-h78q-4j5r-86xx

Cacti graph_view.php RCE via graph_start Parameter Injection

HIGH 73

Cacti versions prior to 0.8.6-d contain a remote command execution vulnerability in the graph_view.php script.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.02815 Published 2025-08-30 Fixed in 0.8.6-d CWE-78

TI-2024-22681 CVE-2024-34340

Authentication Bypass when using using older password hashes

HIGH 72

Cacti provides an operational monitoring and fault management framework.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01119 Published 2024-05-13 Fixed in 1.2.27 CWE-287

TI-2023-19141 CVE-2023-37543 · GHSA-6cj8-h4pg-p2jv

Cacti before 1.2.6 allows IDOR (Insecure Direct Object Reference) for accessing any graph…

HIGH 72

Cacti before 1.2.6 allows IDOR (Insecure Direct Object Reference) for accessing any graph via a modified local_graph_id parameter to graph_xport.php.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00865 Published 2023-08-10 No fix listed CWE-639

TI-2024-36260 CVE-2024-54145

Cacti has a SQL Injection vulnerability when request automation devices

HIGH 71

Cacti is an open source performance and fault management framework.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00672 Published 2025-01-27 Fixed in 1.2.29 CWE-89

TI-2025-18111 CVE-2025-24368

Cacti has a SQL Injection vulnerability when using tree rules through Automation API

HIGH 70

Cacti is an open source performance and fault management framework.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0052 Published 2025-01-27 Fixed in 1.2.29 CWE-89

TI-2024-20823 CVE-2024-31459

Cacti RCE vulnerability by file include in lib/plugin.php

HIGH 70

Cacti provides an operational monitoring and fault management framework.

CVSS 3.1HIGH 8.1 Network High privileges No interaction EPSS 0.02677 Published 2024-05-13 Fixed in 1.2.27 CWE-98

TI-2024-29016 CVE-2024-43365

Stored Cross-site Scripting (XSS) when creating external links in Cacti

HIGH 69

Cacti is an open source performance and fault management framework.

CVSS 3.1HIGH 8.2 Network Low privileges User interaction EPSS 0.2488 Published 2024-10-07 Fixed in 1.2.28 CWE-79

TI-2024-29015 CVE-2024-43364

Stored Cross-site Scripting (XSS) when creating external links in Cacti

HIGH 69

Cacti is an open source performance and fault management framework.

CVSS 3.1HIGH 8.2 Network Low privileges User interaction EPSS 0.37876 Published 2024-10-07 Fixed in 1.2.28 CWE-79

TI-2023-14842 CVE-2023-31132

Cacti Privilege Escalation

HIGH 69

Cacti is an open source operational monitoring and fault management framework.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00411 Published 2023-09-05 Fixed in 1.2.25 CWE-306

Open these records in search →