These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The Cacti sanitize_sql_column() function in lib/functions.php does not properly sanitize user-supplied ORDER BY column names, allowing an authenticated user to perform time-based blind SQL injection attacks. This vulnerability has a CVSS score of 8.8 and is considered HIGH severity. The issue arises from a flawed regex pattern that allows certain characters to pass through unmodified, which can then be co [truncated]
CVE-2026-40084 is a Path Traversal vulnerability in Cacti, a popular open-source performance and fault management framework. The vulnerability affects versions 1.2.30 and prior, allowing attackers to read arbitrary files from the filesystem. This is achieved through a two-stage process: first, an attacker injects a malicious file format into the database, and then, the application reads the file without p [truncated]
CVE-2026-40083 is a SQL injection vulnerability in Cacti, an open-source performance and fault management framework. The issue affects versions 1.2.30 and prior, where unsanitized unserialize and implode functions in managers.php allow for SQL injection. Specifically, the application deserializes user-input data without proper validation, leading to potential SQL injection when using SNMP agent management [truncated]
CVE-2022-46169 is a Cacti command injection vulnerability that CISA placed in the Known Exploited Vulnerabilities catalog on 2023-02-16. Because it is marked as actively exploited, organizations running Cacti should treat remediation as urgent and apply vendor-recommended updates as soon as possible.