CRITICAL🇵🇱 Wersja polska

CVE-2026-39955

CVSS 9.8v3.1pub. 2026-06-24upd. 2026-06-26

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have pre-authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.php. This issue has been fixed in version 1.2.31.

🇵🇱 Read Polish description →

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Cacti
APP
Cacti
< 1.2.31

🔵

CHECK WITH VENDOR

No clear patch data available. Check vendor references.

Tags

SQLi

CWE

CWE-89

References

github.com/Cacti/cacti/commit/4c09efaebf3a9faec66969d0b…

github.com/Cacti/cacti/security/advisories/GHSA-gp82-qh…

Related vulnerabilities

CVE-2022-46169CRITICAL9.8⚠ KEVten sam produkt

Cacti is an open source platform which provides a robust and extensible operational monitoring and fault manag...

CVE-2026-39938CRITICAL9.8PL ✓ten sam produkt

Niezautoryzowany path traversal i command injection w Cacti (LFI)

CVE-2026-39948CRITICAL9.3PL ✓ten sam produkt

Cacti: Pre-auth SQL injection przez parametr rfilter (SQLi)

CVE-2026-39893CRITICAL9.8PL ✓ten sam produkt

SQL Injection w Cacti — atak bez uwierzytelnienia przez parametr rfilter

CVE-2025-22604CRITICAL9.1PL ✓ten sam produkt

Cacti: Command Injection przez malformowane OID w parserze SNMP