CVE-2023-51448: Cacti

High severity, CVSS 8.8. EPSS: 67.3% chance of exploitation in the next 30 days.

Cacti provides an operational monitoring and fault management framework. Version 1.2.25 has a Blind SQL Injection (SQLi) vulnerability within the SNMP Notification Receivers feature in the file `‘managers.php’`. An authenticated attacker with the “Settings/Utilities” permission can send a crafted HTTP GET request to the endpoint `‘/cacti/managers.php’` with an SQLi payload in the `‘selected_graphs_array’` HTTP GET parameter. As of time of publication, no patched versions exist.

Affected products

• Cacti Cacti: version 1.2.25 only

Published 2023-12-22. Last modified 2026-06-17.