CVE-2024-54146CWE-89

Cacti has a SQL Injection vulnerability when view host template

High · published January 27, 2025

CVSS v3.1

7.6

EPSS

46%

Percentile

98.8

In the wild

Unconfirmed

What it is

Cacti is an open source performance and fault management framework. Cacti has a SQL injection vulnerability in the template function of host_templates.php using the graph_template parameter. This vulnerability is fixed in 1.2.29.

The record

Technical detail

CVSS v3.1: 7.6 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
CVSS v4.0: Not supplied
EPSS: 0.46129 · 98.8th percentile
Weakness: CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published: 2025-01-27T17:04Z

EPSS history

Timeline

27 JAN 17:04Z
Cacti has a SQL Injection vulnerability when view host template
cvelistv5