Unscored severity · published Mar 27, 2014
CVE-2014-2326
Cross-site scripting (XSS) vulnerability in cdef.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors
–
CVSS
3.2%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in cdef.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.2% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
Cacti · Cacti
0.8.7g · source: NVD
DL
Debian Linux · Debian
7.0 · source: NVD
FE
Fedora · Fedoraproject
19; 20 · source: NVD
OP
Opensuse · Opensuse
13.1; 13.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-2326
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-2326
Issue Tracking
http://bugs.cacti.net/view.php?id=2431
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131821.html
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131842.html
Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2015-03/msg00034.html
Exploit
http://packetstormsecurity.com/files/125849/Deutsche-Telekom-CERT-Advisory-DTC-A-20140324-001.html
secunia.com
http://secunia.com/advisories/57647
More from Cacti
9.8
CVE-2022-46169
Unauthenticated Command Injection
10.0
CVE-2024-29895
Cacti command injection in cmd_realtime.php
9.8
CVE-2026-40079
Cacti: Command Injection via escape_command() no-op in RRDtool execution
9.8
CVE-2026-39948
Cacti has SQL Injection via rfilter parameter in RLIKE clauses
9.8
CVE-2026-39955
Cacti has Pre-Authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.php