CVE-2005-2149: The Cacti Group Cacti

High severity, CVSS 10.0. EPSS: 2.3% chance of exploitation in the next 30 days.

config.php in Cacti 0.8.6e and earlier allows remote attackers to set the no_http_headers switch, then modify session information to gain privileges and disable the use of addslashes to conduct SQL injection attacks.

Affected products

• The Cacti Group Cacti: version 0.8 only; version 0.8.1 only; version 0.8.2 only; version 0.8.2a only; version 0.8.3 only; version 0.8.3a only; …

Published 2005-07-06. Last modified 2026-06-16.