GCVE - cpe:2.3:a:the_cacti_group:cacti:0.8.5:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:the_cacti_group:cacti:0.8.5:*:*:*:*:*:*:*

part: a version: 0.8.5 update: *

Vendor	The Cacti Group (`ada599ae-8d9d-5ee0-ab86-a51e2e3e3d80`)
Product	Cacti (`e98cc312-41c8-57da-be5e-e122437314da`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/cacti`	purl2cpe	2026-06-01 10:17:15.133816
`pkg:deb/ubuntu/cacti`	purl2cpe	2026-06-01 10:17:15.133818
`pkg:github/cacti/cacti`	purl2cpe	2026-06-01 10:17:15.133820
`pkg:rpm/fedora/cacti`	purl2cpe	2026-06-01 10:17:15.133821
`pkg:rpm/opensuse/cacti`	purl2cpe	2026-06-01 10:17:15.133822

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2005-2149`	vulnerable	2026-06-08 04:48:28.502159	Details available config.php in Cacti 0.8.6e and earlier allows remote attackers to set the no_http_headers switch, then modify session information to gain privileges and disable the use of addslashes to conduct SQL injection attacks. Published: 2005-07-06T04:00:00.000Z Updated: 2024-08-07T22:15:37.380Z Open on db.gcve.eu Reference links http://www.cacti.net/downloads/patches/0.8.6e/cacti-0.8.6f_security.patch http://www.hardened-php.net/advisory-052005.php http://www.securityfocus.com/bid/14130 http://sourceforge.net/mailarchive/forum.php?forum_id=10360&max_rows=25&style=flat&viewmonth=200507&viewday=1 http://www.vupen.com/english/advisories/2005/0951	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-2148`	vulnerable	2026-06-08 04:48:28.497582	Details available Cacti 0.8.6e and earlier does not perform proper input validation to protect against common attacks, which allows remote attackers to execute arbitrary commands or SQL by sending a legitimate value in a POST request or cookie, then specifying the attack string in the URL, which causes the get_request_var function to return the wrong value in the $_REQUEST variable, which is cleansed while the original malicious $_GET value remains unmodified, as demonstrated in (1) graph_image.php and (2) graph.php. Published: 2005-07-06T04:00:00.000Z Updated: 2024-08-07T22:15:37.437Z Open on db.gcve.eu Reference links http://www.cacti.net/downloads/patches/0.8.6e/cacti-0.8.6f_security.patch https://exchange.xforce.ibmcloud.com/vulnerabilities/21270 http://www.hardened-php.net/advisory-032005.php http://www.securityfocus.com/archive/1/404047/30/30/threaded http://www.securityfocus.com/archive/1/404054	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2004-1737`	vulnerable	2026-06-08 04:47:54.956718	Details available SQL injection vulnerability in auth_login.php in Cacti 0.8.5a allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username or (2) password parameters. Published: 2005-02-26T05:00:00.000Z Updated: 2024-08-08T01:00:37.152Z Open on db.gcve.eu Reference links http://lists.grok.org.uk/pipermail/full-disclosure/2004-August/025376.html https://exchange.xforce.ibmcloud.com/vulnerabilities/17011 http://www.securityfocus.com/bid/10960 http://secunia.com/advisories/12308 http://marc.info/?l=bugtraq&m=109272483621038&w=2	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Cacti

Notes

PURL mappings

Vulnerability references

Contribute