PHP remote file inclusion vulnerability in config_settings.php in Cacti before 0.8.6e allows remote attackers to execute arbitrary PHP code via the config[include_path] parameter.
SQL injection vulnerability in auth_login.php in Cacti 0.8.5a allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username or (2) password parameters.
graphs.php in Cacti before 0.6.8 allows remote authenticated Cacti administrators to execute arbitrary commands via shell metacharacters in the title during edit mode.
SQL injection vulnerability in config_settings.php for Cacti before 0.8.6e allows remote attackers to execute arbitrary SQL commands via the id parameter.
PHP file inclusion vulnerability in top_graph_header.php in Cacti 0.8.6d and possibly earlier versions allows remote attackers to execute arbitrary PHP code via the config[library_path] parameter.
Cacti before 0.6.8 stores a MySQL username and password in plaintext in config.php, which has world-readable permissions, which allows local users to modify databases as the Cacti user and possibly gain privileges.
Published 2004-09-01 · Modified
4.6EPSS 0.005
Demo
ThreatFusionAI™ Product Walkthrough
The fastest way to see what ThreatFusionAI does is to run a search. Paste any hash, IP, domain or CVE and you'll get the full report, the connected indicators and the actor attribution in one pass.
What you'll see
• Verdicts from multiple antivirus engines
• The connected IOC graph you can click through
• Ranked threat actors based on ATT&CK overlap
Next step
Start with a free search, no card needed. Check the plans if you need more volume.
ThreatFusionAI AssistantAI help & guidance
AI assistant — can make mistakes. Verify important results.