← Vulnerability feed

Vulnerability record · CVE-2008-0783 · published 14 February 2008

CVE-2008-0783: Cacti cross-site scripting vulnerability

Cacti · Cacti

Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allow remote attackers to inject arbitrary web script or HTML via (1) the view_type parameter to graph.php; (2) the filter parameter to graph_view.php; (3) the action parameter to the draw_navigation_text function in lib/functions.php, reachable through index.php (aka the login page) or data_input.php; or (4) the login_username parameter to index.php.

4.3 CVSS 2.0 Medium EPSS 5.2% · top 7.8% CWE-79 · Cross-site scripting
4.3CVSS 2.0 base score
5.2%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
44References, 2 tagged exploit
16 Jun 2026Last modified by NVD

Description

Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allow remote attackers to inject arbitrary web script or HTML via (1) the view_type parameter to graph.php; (2) the filter parameter to graph_view.php; (3) the action parameter to the draw_navigation_text function in lib/functions.php, reachable through index.php (aka the login page) or data_input.php; or (4) the login_username parameter to index.php.

AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://bugs.cacti.net/view.php?id=1245
http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html
http://secunia.com/advisories/28872 Vendor Advisory
http://secunia.com/advisories/28976 Vendor Advisory
http://secunia.com/advisories/29242 Vendor Advisory
http://secunia.com/advisories/29274
http://secunia.com/advisories/30045 Vendor Advisory
http://security.gentoo.org/glsa/glsa-200803-18.xml
http://securityreason.com/securityalert/3657
http://www.cacti.net/release_notes_0_8_7b.php Patch
http://www.debian.org/security/2008/dsa-1569
http://www.mandriva.com/security/advisories?name=MDVSA-2008:052
http://www.securityfocus.com/archive/1/488013/100/0/threaded
http://www.securityfocus.com/archive/1/488018/100/0/threaded
http://www.securityfocus.com/bid/27749 ExploitPatch
http://www.securityfocus.com/bid/34991
http://www.securitytracker.com/id?1019414
http://www.vupen.com/english/advisories/2008/0540 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=432758
https://exchange.xforce.ibmcloud.com/vulnerabilities/50575
https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00570.html
https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00593.html
http://bugs.cacti.net/view.php?id=1245
http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html
http://secunia.com/advisories/28872 Vendor Advisory
http://secunia.com/advisories/28976 Vendor Advisory
http://secunia.com/advisories/29242 Vendor Advisory
http://secunia.com/advisories/29274
http://secunia.com/advisories/30045 Vendor Advisory
http://security.gentoo.org/glsa/glsa-200803-18.xml
http://securityreason.com/securityalert/3657
http://www.cacti.net/release_notes_0_8_7b.php Patch
http://www.debian.org/security/2008/dsa-1569
http://www.mandriva.com/security/advisories?name=MDVSA-2008:052
http://www.securityfocus.com/archive/1/488013/100/0/threaded
http://www.securityfocus.com/archive/1/488018/100/0/threaded
http://www.securityfocus.com/bid/27749 ExploitPatch
http://www.securityfocus.com/bid/34991
http://www.securitytracker.com/id?1019414
http://www.vupen.com/english/advisories/2008/0540 Vendor Advisory

Track CVE-2008-0783 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-46169Cacti remote_agent.php auth bypass leads to OS command injectionCacti's remote_agent.php trusts attacker-controlled HTTP headers when resolving the client IP, letting an unauthenticated attacker spoof the poller h…KEVEPSS 100%analysed9.8CVE-2026-39938Cacti path traversal vulnerabilityCacti is an open source performance and fault management framework. Versions 1.2.30 and prior have unauthenticated LFI through graph_theme and rrdtoo…EPSS 0.69%9.8CVE-2026-39955Cacti sql injection vulnerabilityCacti is an open source performance and fault management framework. Versions 1.2.30 and prior have pre-authentication SQL Injection via unanchored FI…EPSS 0.59%9.8CVE-2026-39893Cacti sql injection vulnerabilityCacti is an open source performance and fault management framework. In versions 1.2.30 and prior, the rfilter request variable was concatenated into …EPSS 0.67%9.8CVE-2025-26520Cacti sql injection vulnerabilityCacti through 1.2.29 allows SQL injection in the template function in host_templates.php via the graph_template parameter. NOTE: this issue exists be…EPSS 0.48%9.8CVE-2023-39361Cacti graph_view.php SQL injection allows unauthenticated guest accessCacti's graph_view.php is vulnerable to SQL injection. Guest users can reach graph_view.php without authentication by default, so when guest access i…EPSS 89%analysed9.8CVE-2022-0730Cacti improper authentication vulnerabilityUnder certain ldap conditions, Cacti authentication can be bypassed with certain credential types.EPSS 3.5%9.8CVE-2017-12065Cacti vulnerabilityspikekill.php in Cacti before 1.1.16 might allow remote attackers to execute arbitrary code via the avgnan, outlier-start, or outlier-end parameter.EPSS 2.9%

Source: NIST National Vulnerability Database (record CVE-2008-0783), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.