Cacti vulnerabilities
We track 37 vulnerabilities in Cacti products. 37 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on October 23, 2026.
Latest Cacti vulnerabilities
- 7.2 High severity
cacti: Improper Neutralization of Special Elements used in an OS Command
Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ([;&| `$\\n\r]) omitted single-quote, double-quote, redirect operators, subshell parens and braces. An authenticated admin could save an input_stri
- 8.8 High severity
cacti: Improper Neutralization of Special Elements used in an SQL Command
Cacti's sanitize_sql_column (lib/functions.php) sanitizes user-supplied ORDER BY column names using the regex . Because this allowlist retains letters, digits, underscore, parentheses, and dot (intended to support expressions like COUNT(id) and table.column),
- 7.2 High severity
cacti: Improper Neutralization of Special Elements used in an SQL Command
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have SQL Injection through unsanitized unserialize+implode in managers.php. At line 756 of managers.php, the application assigns $selected_items by calling cacti_unse
- 9.8 Critical severity
cacti: Improper Neutralization of Special Elements used in an OS Command
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Command Injection due to lack of sanitization in the escape_command() function. The escape_command() function at lib/rrd.php is a no-op: it returns
- 8.8 High severity
cacti: Improper Neutralization of Special Elements used in an SQL Command
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have a Stored SQL Injection vulnerability through graph_name_regexp in the Reports feature. This issue has been fixed in version 1.2.31.
- 9.8 Critical severity
cacti: Improper Neutralization of Special Elements used in an SQL Command
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have pre-authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.php. This issue has been fixed in version 1.2.31.
- 9.8 Critical severity
cacti: Improper Neutralization of Special Elements used in an SQL Command
Cacti is an open source performance and fault management framework. In versions 1.2.30 and prior, the rfilter request parameter is retrieved via the raw accessor grv() (rather than gfrv() with FILTER_VALIDATE_IS_REGEX validation) and concatenated directly into
- 9.8 Critical severity
cacti: Improper Limitation of a Pathname to a Restricted Directory
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have unauthenticated LFI through graph_theme and rrdtool IPC serialization hardening. This issue has been resolved in version 1.2.31.
- 9.8 Critical severity
cacti: Improper Neutralization of Special Elements used in an SQL Command
Cacti is an open source performance and fault management framework. In versions 1.2.30 and prior, the rfilter request variable was concatenated into a RLIKE SQL clause without sanitization. The endpoint does not require authentication (graph viewing supports g
- 8.8 High severity
cacti: Improper Neutralization of Special Elements used in a Command
Cacti is an open source performance and fault management framework. Prior to 1.2.29, there is an input-validation flaw in the SNMP device configuration functionality. An authenticated Cacti user can supply crafted SNMP community strings containing control char
- 9.8 Critical severity
Cacti: Improper Neutralization of Special Elements used in an SQL Command
Cacti through 1.2.29 allows SQL injection in the template function in host_templates.php via the graph_template parameter. NOTE: this issue exists because of an incomplete fix for CVE-2024-54146.
- 7.5 High severity
cacti: Improper Neutralization of Special Elements used in an SQL Command
Cacti is an open source performance and fault management framework. Some of the data stored in automation_tree_rules.php is not thoroughly checked and is used to concatenate the SQL statement in build_rule_item_filter() function from lib/api_automation.php, re
- 8.8 High severity
cacti: Improper Neutralization of Line Delimiters
Cacti is an open source performance and fault management framework. An authenticated Cacti user can abuse graph creation and graph template functionality to create arbitrary PHP scripts in the web root of the application, leading to remote code execution on th
- 7.2 High severity
cacti: Improper Neutralization of Special Elements used in an OS Command
Cacti is an open source performance and fault management framework. Due to a flaw in multi-line SNMP result parser, authenticated users can inject malformed OIDs in the response. When processed by ss_net_snmp_disk_io() or ss_net_snmp_disk_bytes(), a part of ea
- 8.8 High severity
cacti: Improper Neutralization of Special Elements used in an SQL Command
Cacti is an open source performance and fault management framework. Cacti has a SQL injection vulnerability in the template function of host_templates.php using the graph_template parameter. This vulnerability is fixed in 1.2.29.
- 8.8 High severity
cacti: Improper Neutralization of Special Elements used in an SQL Command
Cacti is an open source performance and fault management framework. Cacti has a SQL injection vulnerability in the get_discovery_results function of automation_devices.php using the network parameter. This vulnerability is fixed in 1.2.29.
- 8.2 High severity
cacti: Improper Neutralization of Input During Web Page Generation
Cacti is an open source performance and fault management framework. The`consolenewsection` parameter is not properly sanitized when saving external links in links.php . Morever, the said consolenewsection parameter is stored in the database and reflected back
- 8.2 High severity
cacti: Improper Neutralization of Input During Web Page Generation
Cacti is an open source performance and fault management framework. The `title` parameter is not properly sanitized when saving external links in links.php . Morever, the said title parameter is stored in the database and reflected back to user in index.php, f
- 7.2 High severity
cacti: Improper Control of Generation of Code
Cacti is an open source performance and fault management framework. An admin user can create a device with a malicious hostname containing php code and repeat the installation process (completing only step 5 of the installation process is enough, no need to co
- 9.1 Critical severity
cacti: Incorrect Comparison
Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, Cacti calls `compat_password_hash` when users set their password. `compat_password_hash` use `password_hash` if there is it, else use `md5`. When verifying passwo
- 8.8 High severity
cacti: Improper Neutralization of Special Elements used in an SQL Command
Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in `automation_tree_rules.php` is not thoroughly checked and is used to concatenate the SQL statement in `create_all_header_nodes()` funct
- 7.2 High severity
cacti: Improper Control of Filename for Include/Require Statement in PHP Program
Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, there is a file inclusion issue in the `lib/plugin.php` file. Combined with SQL injection vulnerabilities, remote code execution can be implemented. There is a fi
- 8.0 High severity
cacti: Improper Neutralization of Special Elements used in an SQL Command
Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in `form_save()` function in `graph_template_inputs.php` is not thoroughly checked and is used to concatenate the SQL statement in `draw_n
- 8.8 High severity
cacti: Improper Neutralization of Special Elements used in an SQL Command
Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, a SQL injection vulnerability in `automation_get_new_graphs_sql` function of `api_automation.php` allows authenticated users to exploit these SQL injection vulner
- 10.0 Critical severity
cacti: Improper Neutralization of Special Elements used in a Command
Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows any unauthenticated user to execute arbitrary command on the server when `register_argc_argv` option of PHP is `On`. In `c
- 7.2 High severity
Cacti provides an operational monitoring and fault management framework.
Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, an arbitrary file write vulnerability, exploitable through the "Package Import" feature, allows authenticated users having the "Import Templates" permission to ex
- 8.8 High severity
cacti: Improper Neutralization of Special Elements used in an SQL Command
Cacti provides an operational monitoring and fault management framework. Version 1.2.25 has a Blind SQL Injection (SQLi) vulnerability within the SNMP Notification Receivers feature in the file `‘managers.php’`. An authenticated attacker with the “Settings/Uti
- 8.8 High severity
cacti: Improper Neutralization of Special Elements used in an SQL Command
Cacti provides an operational monitoring and fault management framework. In versions 1.2.25 and prior, it is possible to execute arbitrary SQL code through the `pollers.php` script. An authorized user may be able to execute arbitrary SQL code. The vulnerable c
- 8.8 High severity
cacti: Improper Control of Filename for Include/Require Statement in PHP Program
Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). While using the detected SQL Injection and insufficient processing of the include file path, it is possible to execute arbitrary code on the
- 7.2 High severity
cacti: Improper Neutralization of Special Elements used in a Command
Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, under certain conditions, an authenticated privileged user, can use a malicious string in the SNMP options of a Device, performing command injection and obtaining r
- 8.8 High severity
cacti: Improper Neutralization of Special Elements used in an SQL Command
Cacti is an open source operational monitoring and fault management framework. An authenticated SQL injection vulnerability was discovered which allows authenticated users to perform privilege escalation and remote code execution. The vulnerability resides in
- 8.8 High severity
cacti: Improper Neutralization of Special Elements used in an SQL Command
Cacti is an open source operational monitoring and fault management framework. A defect in the sql_save function was discovered. When the column type is numeric, the sql_save function directly utilizes user input. Many files and functions calling the sql_save
- 7.8 High severity
cacti: Missing Authentication for Critical Functionality
Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a privilege escalation vulnerability. A low-privileged OS user with access to a Windows host where Cacti is installed can create arbitrary PHP files
- 9.8 Critical severity
cacti: Improper Neutralization of Special Elements used in an SQL Command
Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a SQL injection discovered in graph_view.php. Since guest users can access graph_view.php without authentication by default, if guest users are bein
- 8.8 High severity
cacti: Improper Neutralization of Special Elements used in an SQL Command
Cacti is an open source operational monitoring and fault management framework. An authenticated SQL injection vulnerability was discovered which allows authenticated users to perform privilege escalation and remote code execution. The vulnerability resides in
- 7.5 High severity
Cacti: Authorization Bypass Through User-Controlled Key
Cacti before 1.2.6 allows IDOR (Insecure Direct Object Reference) for accessing any graph via a modified local_graph_id parameter to graph_xport.php. This is a different vulnerability than CVE-2019-16723.
- 9.8 Critical severity
Cacti Command Injection Exploited
Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In affected versions a command injection vulnerability allows an unauthenticated user to execute arbitrary code on a server