📦

cacti

Vendor: cacti

Login to add this product to WatchStack
Actively Exploited 1 CISA KEV List
PoC / Exploits 20 Code Available
Total RCEs 31 Remote Access
Total CVEs 988 Total Indexed
Avg. EPSS 8.78% Exploit Prob.
Latest CVE CVE-2026-40941 Jun 25

Security Vulnerability Index

Page 11 / 99
6.1 CVSS
CVE-2017-15194

include/global_session.php in Cacti 1.1.25 has XSS related to (1) the URI or (2) the refresh page.

EPSS: 1.07%
5.4 CVSS
CVE-2017-12978

lib/html.php in Cacti before 1.1.18 has XSS via the title field of an external link added by an authenticated user.

EPSS: 0.79%
6.1 CVSS
CVE-2017-12927

A cross-site scripting vulnerability exists in Cacti 1.1.17 in the method parameter in spikekill.php.

EPSS: 1.37%
5.4 CVSS
CVE-2017-12066

Cross-site scripting (XSS) vulnerability in aggregate_graphs.php in Cacti before 1.1.16 allows remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers, related to the $cancel_url variable. NOTE: this vulnerability exists because of an incomplete fix (lack of the htmlspecialchars ENT_QUOTES flag) for CVE-2017-11163.

EPSS: 1.42%
9.8 CVSS
CVE-2017-12065
RCE

spikekill.php in Cacti before 1.1.16 might allow remote attackers to execute arbitrary code via the avgnan, outlier-start, or outlier-end parameter.

EPSS: 2.92%
5.4 CVSS
CVE-2017-11691

Cross-site scripting (XSS) vulnerability in auth_profile.php in Cacti 1.1.13 allows remote attackers to inject arbitrary web script or HTML via specially crafted HTTP Referer headers.

EPSS: 1.99%
6.1 CVSS
CVE-2017-1000032

Cross-Site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote attackers to inject arbitrary web script or HTML via the parent_id parameter to tree.php and drp_action parameter to data_sources.php.

EPSS: 0.89%
8.8 CVSS
CVE-2017-1000031

SQL injection vulnerability in graph_templates_inputs.php in Cacti 0.8.8b allows remote attackers to execute arbitrary SQL commands via the graph_template_input_id and graph_template_id parameters.

EPSS: 1.39%
5.4 CVSS
CVE-2017-11163

Cross-site scripting (XSS) vulnerability in aggregate_graphs.php in Cacti 1.1.12 allows remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers, related to the $cancel_url variable.

EPSS: 1.28%
5.4 CVSS
CVE-2017-10970

Cross-site scripting (XSS) vulnerability in link.php in Cacti 1.1.12 allows remote anonymous users to inject arbitrary web script or HTML via the id parameter, related to the die_html_input_error function in lib/html_validate.php.

EPSS: 0.64%