CVE-2022-48547: Cacti

Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days.

A reflected cross-site scripting (XSS) vulnerability in Cacti 0.8.7g and earlier allows unauthenticated remote attackers to inject arbitrary web script or HTML in the "ref" parameter at auth_changepassword.php.

Affected products

• Cacti Cacti: up to and including 0.8.7g

Published 2023-08-22. Last modified 2026-06-17.