Cacti
Monthly
The graph settings script (graph_settings.php) in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a font size, related to the rrdtool. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote attackers to inject arbitrary web script or HTML via the (1) drp_action parameter to cdef.php, (2) data_input.php, (3). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
SQL injection vulnerability in superlinks.php in the superlinks plugin 1.4-2 for Cacti allows remote attackers to execute arbitrary SQL commands via the id parameter. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
lib/rrd.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified parameters. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity.
lib/graph_export.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote authenticated users to execute arbitrary commands via shell metacharacters in unspecified vectors. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. No vendor patch available.
Multiple SQL injection vulnerabilities in graph_xport.php in Cacti 0.8.7g, 0.8.8b, and earlier allow remote attackers to execute arbitrary SQL commands via the (1) graph_start, (2) graph_end, (3). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity.
Cross-site scripting (XSS) vulnerability in cdef.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available.
SQL injection vulnerability in cacti/host.php in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity.
Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.8b and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the step parameter to install/index.php or (2). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
(1) snmp.php and (2) rrd.php in Cacti before 0.8.8b allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
Multiple SQL injection vulnerabilities in (1) api_poller.php and (2) utility.php in Cacti before 0.8.8b allow remote attackers to execute arbitrary SQL commands via unspecified vectors. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity.
Cacti, the open-source network monitoring and graphing solution, contains an unspecified vulnerability addressed in Alpine Linux package version 1.2.31-0. The vulnerability type, affected component, and attacker-accessible impact are not disclosed in the available intelligence. No public exploit has been identified at time of analysis, and CISA KEV listing is absent, leaving severity and exploitation conditions uncharacterized from the data provided.
Cacti, the network monitoring and graphing tool, received a security fix in Alpine Linux package version 1.2.31-0. The specific vulnerability class, technical root cause, and impact scope are not disclosed in the available intelligence. No CVSS score, CWE identifier, or advisory narrative accompanies this CVE at time of analysis, making independent severity assessment impossible from provided data alone.
Cacti, a network graphing and monitoring solution, has a vulnerability addressed by Alpine Linux in package version 1.2.31-0. The nature of the flaw, its impact class, and affected attack surface are not described in the available intelligence - only the fix version is confirmed. Security teams should treat this as a priority update for Alpine Linux deployments running Cacti below version 1.2.31-0 until upstream details are published.
Cacti, the open-source network graphing and monitoring tool, received a security fix in Alpine Linux package version 1.2.31-0. The CVE record contains only a terse Alpine Linux vendor advisory noting the fix - no vulnerability description, CVSS scoring, CWE classification, or exploit data is available at time of analysis. Security teams should treat this as a patch-track item pending full NVD enrichment, and upgrade Alpine-packaged Cacti installations to 1.2.31-0 or later as a precaution.
Cacti, the open-source network graphing and monitoring solution, received a security fix in Alpine Linux package version 1.2.31-0. The specific vulnerability class, impact, and exploitation conditions are not disclosed in available intelligence - only the patched package version in the Alpine Linux ecosystem is confirmed. Security teams running Cacti on Alpine Linux should treat this as a security-relevant update pending fuller disclosure.
Cacti network monitoring software received a security fix packaged as version 1.2.31-0 in Alpine Linux, addressing CVE-2026-40084. The upstream vulnerability details - including attack vector, root cause, and impact - are not disclosed in available intelligence sources. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Cacti, the network monitoring and graphing tool packaged for Alpine Linux, was patched at version 1.2.31-0 to address CVE-2026-39899. The nature, class, and severity of the underlying vulnerability are not disclosed in available data - no description, CWE, or CVSS vector was provided. No public exploit and no CISA KEV listing have been identified at time of analysis.
The graph settings script (graph_settings.php) in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a font size, related to the rrdtool. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote attackers to inject arbitrary web script or HTML via the (1) drp_action parameter to cdef.php, (2) data_input.php, (3). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
SQL injection vulnerability in superlinks.php in the superlinks plugin 1.4-2 for Cacti allows remote attackers to execute arbitrary SQL commands via the id parameter. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
lib/rrd.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified parameters. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity.
lib/graph_export.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote authenticated users to execute arbitrary commands via shell metacharacters in unspecified vectors. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. No vendor patch available.
Multiple SQL injection vulnerabilities in graph_xport.php in Cacti 0.8.7g, 0.8.8b, and earlier allow remote attackers to execute arbitrary SQL commands via the (1) graph_start, (2) graph_end, (3). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity.
Cross-site scripting (XSS) vulnerability in cdef.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available.
SQL injection vulnerability in cacti/host.php in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity.
Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.8b and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the step parameter to install/index.php or (2). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
(1) snmp.php and (2) rrd.php in Cacti before 0.8.8b allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
Multiple SQL injection vulnerabilities in (1) api_poller.php and (2) utility.php in Cacti before 0.8.8b allow remote attackers to execute arbitrary SQL commands via unspecified vectors. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity.
Cacti, the open-source network monitoring and graphing solution, contains an unspecified vulnerability addressed in Alpine Linux package version 1.2.31-0. The vulnerability type, affected component, and attacker-accessible impact are not disclosed in the available intelligence. No public exploit has been identified at time of analysis, and CISA KEV listing is absent, leaving severity and exploitation conditions uncharacterized from the data provided.
Cacti, the network monitoring and graphing tool, received a security fix in Alpine Linux package version 1.2.31-0. The specific vulnerability class, technical root cause, and impact scope are not disclosed in the available intelligence. No CVSS score, CWE identifier, or advisory narrative accompanies this CVE at time of analysis, making independent severity assessment impossible from provided data alone.
Cacti, a network graphing and monitoring solution, has a vulnerability addressed by Alpine Linux in package version 1.2.31-0. The nature of the flaw, its impact class, and affected attack surface are not described in the available intelligence - only the fix version is confirmed. Security teams should treat this as a priority update for Alpine Linux deployments running Cacti below version 1.2.31-0 until upstream details are published.
Cacti, the open-source network graphing and monitoring tool, received a security fix in Alpine Linux package version 1.2.31-0. The CVE record contains only a terse Alpine Linux vendor advisory noting the fix - no vulnerability description, CVSS scoring, CWE classification, or exploit data is available at time of analysis. Security teams should treat this as a patch-track item pending full NVD enrichment, and upgrade Alpine-packaged Cacti installations to 1.2.31-0 or later as a precaution.
Cacti, the open-source network graphing and monitoring solution, received a security fix in Alpine Linux package version 1.2.31-0. The specific vulnerability class, impact, and exploitation conditions are not disclosed in available intelligence - only the patched package version in the Alpine Linux ecosystem is confirmed. Security teams running Cacti on Alpine Linux should treat this as a security-relevant update pending fuller disclosure.
Cacti network monitoring software received a security fix packaged as version 1.2.31-0 in Alpine Linux, addressing CVE-2026-40084. The upstream vulnerability details - including attack vector, root cause, and impact - are not disclosed in available intelligence sources. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Cacti, the network monitoring and graphing tool packaged for Alpine Linux, was patched at version 1.2.31-0 to address CVE-2026-39899. The nature, class, and severity of the underlying vulnerability are not disclosed in available data - no description, CWE, or CVSS vector was provided. No public exploit and no CISA KEV listing have been identified at time of analysis.