Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable web console with low complexity, but a console account is required so PR:L (not PR:N); a SQLi grants full database read/write, justifying C:H/I:H/A:H.
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
9DescriptionNVD
Alpine Linux: cacti fixed in 1.2.31-0
AnalysisAI
SQL injection in Cacti, the open-source network monitoring and graphing platform, lets an authenticated low-privilege user inject crafted database queries (CWE-89), yielding full confidentiality, integrity, and availability impact; it is fixed in version 1.2.31 (Alpine package 1.2.31-0). The flaw is reachable over the network without user interaction, but EPSS is low (0.19%, 8th percentile), there is no public exploit identified at time of analysis, and it is not on CISA KEV. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Recommended ActionAI
Within 24 hours: Identify and document all Cacti deployments in your environment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Cacti monitoring platform prior to version 1.2.29 allows authenticated users to achieve remote code execution through th
Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management fram
Cacti provides an operational monitoring and fault management framework. Rated high severity (CVSS 8.8), this vulnerabil
Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB).
A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. Rated high se
Cacti is an open source operational monitoring and fault management framework. Rated critical severity (CVSS 9.8), this
SQL injection vulnerability in graph_templates_inputs.php in Cacti 0.8.8b allows remote attackers to execute arbitrary S
SQL injection vulnerability in the host_new_graphs function in graphs_new.php in Cacti 0.8.8f and earlier allows remote
SQL injection vulnerability in graph_view.php in Cacti 0.8.8.g allows remote authenticated users to execute arbitrary SQ
SQL injection vulnerability in tree.php in Cacti 0.8.8g and earlier allows remote authenticated users to execute arbitra
Cacti is an open source performance and fault management framework. Prior to 1.2.29, there is an input-validation flaw i
Cacti provides an operational monitoring and fault management framework. Rated high severity (CVSS 8.8), this vulnerabil
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today