CVE-2019-11025: Cacti

Medium severity, CVSS 5.4. EPSS: 1.3% chance of exploitation in the next 30 days.

In clearFilter() in utilities.php in Cacti before 1.2.3, no escaping occurs before printing out the value of the SNMP community string (SNMP Options) in the View poller cache, leading to XSS.

Affected products

• Cacti Cacti: before 1.2.3 (fixed in 1.2.3)
• Debian Debian Linux: version 8.0 only; version 9.0 only

Published 2019-04-08. Last modified 2026-06-17.