Vulnerabilities

TI-2026-79925 CVE-2026-49442

User enumeration via error messages in Cacti

MEDIUM 63

Cacti is an open source performance and fault management framework.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00237 Published 2026-10-23 Fixed in 1.2.31 CWE-204

TI-2026-79919 CVE-2026-39902

OS command injection in Cacti data input allows code execution

LOW 34

Cacti is an open source performance and fault management framework.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00403 Published 2026-10-23 Fixed in 1.2.31 CWE-78

TI-2026-79922 CVE-2026-46531

Stored SQL injection in Cacti automation tree rule items

MEDIUM 58

Cacti is an open source performance and fault management framework.

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00304 Published 2026-10-23 Fixed in 1.2.31 CWE-89

TI-2026-49954 CVE-2026-71287 · GHSA-7v66-c77r-g454

Cacti sanitize_sql_column() Regex Allowlist Permits SQL Time-Delay Functions Leading to Blind SQL Injection

MEDIUM 41

Cacti's sanitize_sql_column (lib/functions.php) sanitizes user-supplied ORDER BY column names using the regex .

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00549 Published 2026-08-05 No fix listed CWE-89

TI-2026-29592 CVE-2026-40941

Cacti: Package Import Signature Validation Bypass Allows Self-Signed Packages

LOW 31

Cacti is an open source performance and fault management framework.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00265 Published 2026-06-25 Fixed in 1.2.31 CWE-347

TI-2026-28913 CVE-2026-40084

Cacti: Arbitrary File Read via Path Traversal in Report `format_file` Parameter

MEDIUM 62

Cacti is an open source performance and fault management framework.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00486 Published 2026-06-25 Fixed in 1.2.31 CWE-22

TI-2026-28912 CVE-2026-40083

Cacti: SQL Injection in managers.php

HIGH 67

Cacti is an open source performance and fault management framework.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00502 Published 2026-06-25 Fixed in 1.2.31 CWE-89

TI-2026-28911 CVE-2026-40082

Cacti: Session Fixation via missing session_regenerate_id() after login

LOW 24

Cacti is an open source performance and fault management framework.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.0032 Published 2026-06-25 Fixed in 1.2.31 CWE-384

TI-2026-28910 CVE-2026-40080

Cacti: Open Redirect via HTTP_REFERER substring check in auth_login_redirect

MEDIUM 60

Cacti is an open source performance and fault management framework.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00257 Published 2026-06-25 Fixed in 1.2.31 CWE-601

TI-2026-28909 CVE-2026-40079

Cacti: Command Injection via escape_command() no-op in RRDtool execution

MEDIUM 49

Cacti is an open source performance and fault management framework.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.0169 Published 2026-06-24 Fixed in 1.2.31 CWE-78

TI-2026-28810 CVE-2026-39951

Cacti: Stored SQL Injection via graph_name_regexp in Reports feature

LOW 38

Cacti is an open source performance and fault management framework.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00397 Published 2026-06-24 Fixed in 1.2.31 CWE-89

TI-2026-28809 CVE-2026-39948

Cacti has SQL Injection via rfilter parameter in RLIKE clauses

MEDIUM 50

Cacti is an open source performance and fault management framework.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00848 Published 2026-06-24 Fixed in 1.2.31 CWE-89

TI-2026-28811 CVE-2026-39955

Cacti has Pre-Authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.php

MEDIUM 50

Cacti is an open source performance and fault management framework.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00585 Published 2026-06-24 Fixed in 1.2.31 CWE-89

TI-2026-28802 CVE-2026-39938

Cacti: Unauthenticated RCE on Graph Image

MEDIUM 50

Cacti is an open source performance and fault management framework.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00693 Published 2026-06-24 Fixed in 1.2.31 CWE-22

TI-2026-28775 CVE-2026-39900

Cacti: Reflected XSS via tab parameter in auth_profile.php JavaScript context

LOW 24

Cacti is an open source performance and fault management framework.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00263 Published 2026-06-24 Fixed in 1.2.31 CWE-79

TI-2026-28774 CVE-2026-39899

Cacti: Path Traversal via filename parameter in package_import.php

LOW 37

Cacti is an open source performance and fault management framework.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00386 Published 2026-06-24 Fixed in 1.2.31 CWE-22

TI-2026-28773 CVE-2026-39897

Cacti has a Reflected XSS Vulnerability via html_auth_footer

LOW 24

Cacti is an open source performance and fault management framework.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00263 Published 2026-06-24 Fixed in 1.2.31 CWE-79

TI-2026-28772 CVE-2026-39894

Cacti: RRDtool metric shift via LC_NUMERIC locale comma decimal formatting

LOW 13

Cacti is an open source performance and fault management framework.

CVSS 3.1LOW 2.9 Local No auth No interaction EPSS 0.00139 Published 2026-06-24 Fixed in 1.2.31 CWE-474

TI-2026-28771 CVE-2026-39893

Cacti: Pre-authentication SQL injection via rfilter RLIKE clause in graph_view.php

MEDIUM 50

Cacti is an open source performance and fault management framework.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00674 Published 2026-06-24 Fixed in 1.2.31 CWE-89

TI-2025-40836 CVE-2025-66399

SNMP Command Injection leads to RCE in Cacti

HIGH 74

Cacti is an open source performance and fault management framework.

CVSS 4.0HIGH 7.4 Network Low privileges No interaction EPSS 0.1085 Published 2025-12-02 Fixed in 1.2.29 CWE-77

TI-2005-04627 CVE-2005-10004 · GHSA-h78q-4j5r-86xx

Cacti graph_view.php RCE via graph_start Parameter Injection

HIGH 73

Cacti versions prior to 0.8.6-d contain a remote command execution vulnerability in the graph_view.php script.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.02815 Published 2025-08-30 Fixed in 0.8.6-d CWE-78

TI-2025-19458 CVE-2025-26520 · GHSA-4755-g2xw-m698

SQL injection in Cacti

MEDIUM 43

Cacti through 1.2.29 allows SQL injection in the template function in host_templates.php via the graph_template parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00484 Published 2025-02-12 No fix listed CWE-89

TI-2025-18111 CVE-2025-24368

Cacti has a SQL Injection vulnerability when using tree rules through Automation API

HIGH 70

Cacti is an open source performance and fault management framework.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0052 Published 2025-01-27 Fixed in 1.2.29 CWE-89

TI-2025-18110 CVE-2025-24367

Cacti allows Arbitrary File Creation leading to RCE

HIGH 78

Cacti is an open source performance and fault management framework.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.58848 Published 2025-01-27 No fix listed CWE-144

TI-2025-16490 CVE-2025-22604

Cacti has Authenticated RCE via multi-line SNMP responses

HIGH 74

Cacti is an open source performance and fault management framework.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.05302 Published 2025-01-27 No fix listed CWE-78

Vulnerabilities

Filters