CVE-2020-14424: Cacti

Medium severity, CVSS 6.1. EPSS: 1.6% chance of exploitation in the next 30 days.

Cacti before 1.2.18 allows remote attackers to trigger XSS via template import for the midwinter theme.

Affected products

• Cacti Cacti: before 1.2.18 (fixed in 1.2.18)

Published 2021-11-14. Last modified 2026-06-17.