Unscored severity · published Aug 23, 2010
CVE-2010-2543
Cross-site scripting (XSS) vulnerability in include/top_graph_header.php in Cacti before 0.8.7g allows remote attackers to inject arbitrary web script or HTML via the graph_start…
–
CVSS
3.9%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in include/top_graph_header.php in Cacti before 0.8.7g allows remote attackers to inject arbitrary web script or HTML via the graph_start parameter to graph.php. NOTE: this vulnerability exists because of an incorrect fix for CVE-2009-4032.2.b.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.9% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
Cacti · Cacti
through 0.8.7f; 0.5; 0.6; 0.6.1; 0.6.2; 0.6.3; +32 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-2543
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-2543
Vendor Advisory
http://cacti.net/release_notes_0_8_7g.php
marc.info
http://marc.info/?l=oss-security&m=127978954522586&w=2
marc.info
http://marc.info/?l=oss-security&m=128017203704299&w=2
svn.cacti.net
http://svn.cacti.net/viewvc/cacti/branches/0.8.7/include/top_graph_header.php?r1=6025&r2=6024
svn.cacti.net
http://svn.cacti.net/viewvc?view=rev&revision=6025
www.mandriva.com
http://www.mandriva.com/security/advisories?name=MDVSA-2010:160
More from Cacti
9.8
CVE-2022-46169
Unauthenticated Command Injection
10.0
CVE-2024-29895
Cacti command injection in cmd_realtime.php
9.8
CVE-2026-40079
Cacti: Command Injection via escape_command() no-op in RRDtool execution
9.8
CVE-2026-39948
Cacti has SQL Injection via rfilter parameter in RLIKE clauses
9.8
CVE-2026-39955
Cacti has Pre-Authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.php