CVE-2005-10004CWE-78command-injection

CVE-2005-10004

High · published August 30, 2025

CVSS v3.1
8.8
EPSS
3%
Percentile
86.3
In the wild
Unconfirmed
What it is

Cacti versions prior to 0.8.6-d contain a remote command execution vulnerability in the graph_view.php script. An authenticated user can inject arbitrary shell commands via the graph_start GET parameter, which is improperly handled during graph rendering. This flaw allows attackers to execute commands on the underlying operating system with the privileges of the web server process, potentially compromising system integrity.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02795 · 86.3th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-08-30T18:15Z
Affected products (1)
ProductVersionsFixed in
cacti/cacti< 0.8.6d0.8.6d
References (6)
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/cacti_graphimage_exec.rb · [email protected]https://web.archive.org/web/20050305034552/http://www.cacti.net/cactid_download.php · [email protected]https://www.cacti.net/info/downloads · [email protected]https://www.exploit-db.com/exploits/16881 · [email protected]https://www.exploit-db.com/exploits/9911 · [email protected]https://www.vulncheck.com/advisories/cacti-graph-view-rce · [email protected]
EPSS history
Timeline
  • 30 AUG 13:45Z
    Cacti graph_view.php RCE via graph_start Parameter Injection
    cvelistv5