en
Cacti is an open-source performance and fault management framework maintained by a global project community. It operates in network and systems monitoring, using RRDtool-based time-series storage, data collectors, graphing, templates, plugins, and web administration for infrastructure operators.
As of 09/13/2026, Cacti recorded 16 security vulnerabilities in the last 90 days across 1 products, including 9 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, cacti had the most security vulnerabilities in the Cacti ecosystem, with 16 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-71287Cacti sanitize_sql_column() Regex Allowlist Permits SQL Time-Delay Functions Leading to Blind SQL Injection | Exploitation statusNot known exploited | FixYes | Affected productcacti | Published08/05/2026 | SeverityHigh |
CVE-2026-40941Cacti: Package Import Signature Validation Bypass Allows Self-Signed Packages | Exploitation statusNot known exploited | FixYes | Affected productcacti | Published06/25/2026 | SeverityHigh |
CVE-2026-40084Cacti: Arbitrary File Read via Path Traversal in Report `format_file` Parameter | Exploitation statusPublic exploit | FixYes | Affected productcacti | Published06/25/2026 | SeverityMedium |
CVE-2026-40083Cacti: SQL Injection in managers.php | Exploitation statusPublic exploit | FixYes | Affected productcacti | Published06/25/2026 | SeverityHigh |
CVE-2026-40082Cacti: Session Fixation via missing session_regenerate_id() after login | Exploitation statusNot known exploited | FixYes | Affected productcacti | Published06/25/2026 | SeverityMedium |
CVE-2026-40080Cacti: Open Redirect via HTTP_REFERER substring check in auth_login_redirect | Exploitation statusPublic exploit | FixYes | Affected productcacti | Published06/25/2026 | SeverityMedium |
CVE-2026-40079Cacti: Command Injection via escape_command() no-op in RRDtool execution | Exploitation statusNot known exploited | FixNot confirmed | Affected productcacti | Published06/24/2026 | SeverityHigh |
CVE-2026-39951Cacti: Stored SQL Injection via graph_name_regexp in Reports feature | Exploitation statusNot known exploited | FixYes | Affected productcacti | Published06/24/2026 | SeverityHigh |
CVE-2026-39948Cacti has SQL Injection via rfilter parameter in RLIKE clauses | Exploitation statusNot known exploited | FixYes | Affected productcacti | Published06/24/2026 | SeverityCritical |
CVE-2026-39955Cacti has Pre-Authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.php | Exploitation statusNot known exploited | FixYes | Affected productcacti | Published06/24/2026 | SeverityCritical |
CVE-2026-39938Cacti: Unauthenticated RCE on Graph Image | Exploitation statusNot known exploited | FixYes | Affected productcacti | Published06/24/2026 | SeverityCritical |
CVE-2026-39900Cacti: Reflected XSS via tab parameter in auth_profile.php JavaScript context | Exploitation statusNot known exploited | FixYes | Affected productcacti | Published06/24/2026 | SeverityMedium |
CVE-2026-39899Cacti: Path Traversal via filename parameter in package_import.php | Exploitation statusNot known exploited | FixYes | Affected productcacti | Published06/24/2026 | SeverityMedium |
CVE-2026-39897Cacti has a Reflected XSS Vulnerability via html_auth_footer | Exploitation statusNot known exploited | FixYes | Affected productcacti | Published06/24/2026 | SeverityMedium |
CVE-2026-39894Cacti: RRDtool metric shift via LC_NUMERIC locale comma decimal formatting | Exploitation statusNot known exploited | FixYes | Affected productcacti | Published06/24/2026 | SeverityLow |
CVE-2026-39893Cacti: Pre-authentication SQL injection via rfilter RLIKE clause in graph_view.php | Exploitation statusNot known exploited | FixYes | Affected productcacti | Published06/24/2026 | SeverityCritical |
CVE-2025-66399SNMP Command Injection leads to RCE in Cacti | Exploitation statusPublic exploit | FixYes | Affected productcacti | Published12/02/2025 | SeverityHigh |
CVE-2005-10004Cacti graph_view.php RCE via graph_start Parameter Injection | Exploitation statusPublic exploit | FixYes | Affected productCacti | Published08/30/2025 | SeverityHigh |
CVE-2025-26520 | Exploitation statusNot known exploited | FixNot confirmed | Affected productcacti | Published02/12/2025 | SeverityHigh |
CVE-2025-24368Cacti has a SQL Injection vulnerability when using tree rules through Automation API | Exploitation statusPublic exploit | FixYes | Affected productcacti | Published01/27/2025 | SeverityMedium |
CVE-2025-24367Cacti allows Arbitrary File Creation leading to RCE | Exploitation statusPublic exploit | FixYes | Affected productcacti | Published01/27/2025 | SeverityHigh |
CVE-2025-22604Cacti has Authenticated RCE via multi-line SNMP responses | Exploitation statusPublic exploit | FixYes | Affected productcacti | Published01/27/2025 | SeverityCritical |
CVE-2024-54145Cacti has a SQL Injection vulnerability when request automation devices | Exploitation statusPublic exploit | FixYes | Affected productcacti | Published01/27/2025 | SeverityMedium |
CVE-2024-54146Cacti has a SQL Injection vulnerability when view host template | Exploitation statusNot known exploited | FixYes | Affected productcacti | Published01/27/2025 | SeverityHigh |
CVE-2024-45598Cacti has a Local File Inclusion (LFI) Vulnerability via Poller Standard Error Log Path | Exploitation statusNot known exploited | FixYes | Affected productcacti | Published01/27/2025 | SeverityMedium |
CVE-2024-43363Remote code execution via Log Poisoning in Cacti | Exploitation statusPublic exploit | FixNot confirmed | Affected productcacti | Published10/07/2024 | SeverityHigh |
CVE-2024-43365Stored Cross-site Scripting (XSS) when creating external links in Cacti | Exploitation statusPublic exploit | FixNot confirmed | Affected productcacti | Published10/07/2024 | SeverityMedium |
CVE-2024-43364Stored Cross-site Scripting (XSS) when creating external links in Cacti | Exploitation statusPublic exploit | FixNot confirmed | Affected productcacti | Published10/07/2024 | SeverityMedium |
CVE-2024-43362Stored Cross-site Scripting (XSS) when creating external links in Cacti | Exploitation statusPublic exploit | FixNot confirmed | Affected productcacti | Published10/07/2024 | SeverityHigh |
CVE-2024-34340Authentication Bypass when using using older password hashes | Exploitation statusPublic exploit | FixNot confirmed | Affected productcacti | Published05/13/2024 | SeverityCritical |
CVE-2024-31460Cacti SQL Injection vulnerability in lib/api_automation.php caused by reading dirty data stored in database | Exploitation statusNot known exploited | FixNot confirmed | Affected productcacti | Published05/13/2024 | SeverityMedium |
CVE-2024-31459Cacti RCE vulnerability by file include in lib/plugin.php | Exploitation statusPublic exploit | FixNot confirmed | Affected productcacti | Published05/13/2024 | SeverityHigh |
CVE-2024-31458Cacti SQL Injection vulnerability in lib/html_form_templates.php by reading dirty data stored in database | Exploitation statusNot known exploited | FixNot confirmed | Affected productcacti | Published05/13/2024 | SeverityMedium |
CVE-2024-31445SQL Injection vulnerability in automation_get_new_graphs_sql | Exploitation statusPublic exploit | FixNot confirmed | Affected productcacti | Published05/13/2024 | SeverityHigh |
CVE-2024-31444Cacti XSS vulnerability in lib/html.php by reading dirty data stored in database | Exploitation statusNot known exploited | FixNot confirmed | Affected productcacti | Published05/13/2024 | SeverityMedium |
CVE-2024-31443Cacti XSS vulnerability in lib/html_tree.php by reading dirty data stored in database | Exploitation statusNot known exploited | FixNot confirmed | Affected productcacti | Published05/13/2024 | SeverityMedium |
CVE-2024-30268Cacti XSS vulnerability in display_settings | Exploitation statusPublic exploit | FixYes | Affected productcacti | Published05/13/2024 | SeverityMedium |
CVE-2024-29895Cacti command injection in cmd_realtime.php | Exploitation statusPublic exploit | FixNot confirmed | Affected productcacti | Published05/13/2024 | SeverityCritical |
CVE-2024-29894Cacti Cross-site Scripting vulnerability when using JavaScript based messaging API | Exploitation statusNot known exploited | FixNot confirmed | Affected productcacti | Published05/13/2024 | SeverityMedium |
CVE-2024-27082Cacti Cross-site Scripting vulnerability when managing trees | Exploitation statusPublic exploit | FixNot confirmed | Affected productcacti | Published05/13/2024 | SeverityHigh |
CVE-2024-25641Cacti RCE vulnerability when importing packages | Exploitation statusPublic exploit | FixNot confirmed | Affected productcacti | Published05/13/2024 | SeverityCritical |
CVE-2023-51448SQL Injection vulnerability when managing SNMP Notification Receivers | Exploitation statusNot confirmed | FixNot confirmed | Affected productcacti | Published12/22/2023 | SeverityHigh |
CVE-2023-50250Cross-Site Scripting vulnerability when Import xml template file | Exploitation statusNot confirmed | FixNot confirmed | Affected productcacti | Published12/22/2023 | SeverityMedium |
CVE-2023-49088Cacti has incomplete fix for CVE-2023-39515 | Exploitation statusPublic exploit | FixNot confirmed | Affected productcacti | Published12/22/2023 | SeverityMedium |
CVE-2023-49085Cacti SQL Injection vulnerability | Exploitation statusPublic exploit | FixNot confirmed | Affected productcacti | Published12/22/2023 | SeverityHigh |
CVE-2023-49086Cacti is vulnerable to cross-Site scripting (XSS) DOM | Exploitation statusNot confirmed | FixYes | Affected productcacti | Published12/21/2023 | SeverityMedium |
CVE-2023-49084Local File Inclusion (RCE) in Cacti | Exploitation statusPublic exploit | FixNot confirmed | Affected productcacti | Published12/21/2023 | SeverityHigh |
CVE-2023-46490 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published10/27/2023 | SeverityUnknown |
CVE-2023-39511Stored Cross-Site-Scripting on reports_admin.php device name in Cacti | Exploitation statusPublic exploit | FixNot confirmed | Affected productcacti | Published09/06/2023 | SeverityMedium |
CVE-2023-30534Insecure Deserialization in Cacti | Exploitation statusPublic exploit | FixNot confirmed | Affected productcacti | Published09/05/2023 | SeverityMedium |
CVE-2023-31132Cacti Privilege Escalation | Exploitation statusPublic exploit | FixNot confirmed | Affected productcacti | Published09/05/2023 | SeverityHigh |
CVE-2023-39362Authenticated command injection in SNMP options of a Device | Exploitation statusPublic exploit | FixNot confirmed | Affected productcacti | Published09/05/2023 | SeverityHigh |
CVE-2023-39364Open redirect in change password functionality in Cacti | Exploitation statusNot confirmed | FixNot confirmed | Affected productcacti | Published09/05/2023 | SeverityLow |
CVE-2023-39516Stored Cross-Site-Scripting on data_sources.php debug html-block in Cacti | Exploitation statusPublic exploit | FixNot confirmed | Affected productcacti | Published09/05/2023 | SeverityMedium |
CVE-2023-39365Unchecked regular expressions can lead to SQL Injection and data leakage in Cacti | Exploitation statusNot known exploited | FixNot confirmed | Affected productcacti | Published09/05/2023 | SeverityMedium |
CVE-2023-39357A Defect in sql_save() Causes Multiple SQL Injection Vulnerabilities in Cacti | Exploitation statusNot confirmed | FixNot confirmed | Affected productcacti | Published09/05/2023 | SeverityHigh |
CVE-2023-39358Authenticated SQL injection vulnerability in reports_user.php in Cacti | Exploitation statusPublic exploit | FixNot confirmed | Affected productcacti | Published09/05/2023 | SeverityHigh |
CVE-2023-39359Authenticated SQL injection vulnerability in graphs.php in Cacti | Exploitation statusPublic exploit | FixNot confirmed | Affected productcacti | Published09/05/2023 | SeverityHigh |
CVE-2023-39361Unauthenticated SQL Injection in graph_view.php in Cacti | Exploitation statusNot confirmed | FixNot confirmed | Affected productcacti | Published09/05/2023 | SeverityCritical |
CVE-2023-39360Reflected Cross-site Scripting in graphs_new.php in Cacti | Exploitation statusNot confirmed | FixNot confirmed | Affected productcacti | Published09/05/2023 | SeverityMedium |
CVE-2023-39366Stored Cross-site Scripting in data_sources.php through Device-Name in 'select' input in Cacti | Exploitation statusPublic exploit | FixNot confirmed | Affected productcacti | Published09/05/2023 | SeverityMedium |
CVE-2023-39510Stored Cross-site Scripting in reports_admin.php through Device-Name in 'select' input in Cacti | Exploitation statusPublic exploit | FixNot confirmed | Affected productcacti | Published09/05/2023 | SeverityMedium |
CVE-2023-39512Stored Cross-site Scripting on data_sources.php device name view in Cacti | Exploitation statusPublic exploit | FixNot confirmed | Affected productcacti | Published09/05/2023 | SeverityMedium |
CVE-2023-39513Stored Cross-site Scripting on host.php verbose data-query debug view in Cacti | Exploitation statusPublic exploit | FixNot confirmed | Affected productcacti | Published09/05/2023 | SeverityMedium |
CVE-2023-39515Stored Cross-site Scripting on data_debug.php datasource path view in Cacti | Exploitation statusPublic exploit | FixNot confirmed | Affected productcacti | Published09/05/2023 | SeverityMedium |
CVE-2023-39514Stored Cross-site Scripting on graphs.php data template formated name view in Cacti | Exploitation statusPublic exploit | FixNot confirmed | Affected productcacti | Published09/05/2023 | SeverityMedium |
CVE-2022-48538 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published08/22/2023 | SeverityUnknown |
CVE-2022-48547 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published08/22/2023 | SeverityUnknown |
CVE-2022-41444 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published08/22/2023 | SeverityUnknown |
CVE-2023-37543 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published08/10/2023 | SeverityUnknown |
CVE-2022-46169Unauthenticated Command Injection | Exploitation statusKEV | FixNot confirmed | Affected productcacti | Published12/05/2022 | SeverityCritical |
CVE-2022-0730 | Exploitation statusNot confirmed | FixNot confirmed | Affected productCati | Published03/03/2022 | SeverityUnknown |
CVE-2021-26247 | Exploitation statusNot confirmed | FixNot confirmed | Affected productCacti | Published01/19/2022 | SeverityUnknown |
CVE-2021-23225 | Exploitation statusNot confirmed | FixNot confirmed | Affected productCacti | Published01/19/2022 | SeverityUnknown |
CVE-2021-3816 | Exploitation statusNot confirmed | FixNot confirmed | Affected productCacti | Published01/19/2022 | SeverityUnknown |
CVE-2020-14424 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published11/14/2021 | SeverityUnknown |
CVE-2020-23226 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/27/2021 | SeverityUnknown |
CVE-2020-35701 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/11/2021 | SeverityUnknown |
CVE-2020-25706 | Exploitation statusNot confirmed | FixNot confirmed | Affected productcacti | Published11/12/2020 | SeverityMedium |
CVE-2020-14295 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/17/2020 | SeverityUnknown |
CVE-2020-13231 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published05/20/2020 | SeverityUnknown |
CVE-2020-13230 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published05/20/2020 | SeverityUnknown |
CVE-2020-8813 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/22/2020 | SeverityUnknown |
CVE-2019-17357 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/21/2020 | SeverityUnknown |
CVE-2020-7237 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/20/2020 | SeverityUnknown |
CVE-2020-7106 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/16/2020 | SeverityUnknown |
CVE-2020-7058 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published01/15/2020 | SeverityUnknown |
CVE-2019-17358 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published12/12/2019 | SeverityUnknown |
CVE-2019-16723 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published09/23/2019 | SeverityUnknown |
CVE-2019-11025 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published04/08/2019 | SeverityUnknown |
CVE-2018-20724 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/16/2019 | SeverityUnknown |
CVE-2018-20726 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/16/2019 | SeverityUnknown |
CVE-2018-20723 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/16/2019 | SeverityUnknown |
CVE-2018-20725 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/16/2019 | SeverityUnknown |
CVE-2018-10061 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published04/12/2018 | SeverityUnknown |
CVE-2018-10059 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published04/12/2018 | SeverityUnknown |
CVE-2018-10060 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published04/12/2018 | SeverityUnknown |
CVE-2016-10700 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published11/24/2017 | SeverityUnknown |
CVE-2014-4000 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published11/15/2017 | SeverityUnknown |
CVE-2017-16785 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published11/10/2017 | SeverityUnknown |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
