CVE-2014-5026: Cacti

Low severity, CVSS 3.5. EPSS: 1.9% chance of exploitation in the next 30 days.

Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote authenticated users with console access to inject arbitrary web script or HTML via a (1) Graph Tree Title in a delete or (2) edit action; (3) CDEF Name, (4) Data Input Method Name, or (5) Host Templates Name in a delete action; (6) Data Source Title; (7) Graph Title; or (8) Graph Template Name in a delete or (9) duplicate action.

Affected products

• Cacti Cacti: version 0.8.8b only
• Debian Debian Linux: version 7.0 only
• Opensuse Opensuse: version 13.1 only; version 13.2 only

Published 2014-10-20. Last modified 2026-06-17.