Unrated severityNVD Advisory· Published Oct 20, 2014· Updated Jun 17, 2026

CVE-2014-5025

Description

Cross-site scripting (XSS) vulnerability in data_sources.php in Cacti 0.8.8b allows remote authenticated users with console access to inject arbitrary web script or HTML via the name_cache parameter in a ds_edit action.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Cacti (software)/Cacti2 versions
cpe:2.3:a:cacti:cacti:0.8.8b:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:cacti:cacti:0.8.8b:*:*:*:*:*:*:*
- (no CPE)range: == 0.8.8b
Debian/linux
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
OpenSUSE/openSUSE2 versions
cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
osv-coords
pkg:rpm/opensuse/cacti&distro=openSUSE%20Tumbleweed
Range: < 0.8.8h-1.2

Patches

Vulnerability mechanics

References

bugs.cacti.net/view.phpnvdExploitIssue TrackingPatchVendor Advisory
www.openwall.com/lists/oss-security/2014/07/22/9nvdExploitMailing ListThird Party Advisory
lists.opensuse.org/opensuse-updates/2015-03/msg00034.htmlnvdThird Party Advisory
www.debian.org/security/2014/dsa-3007nvdThird Party Advisory
www.securityfocus.com/bid/68759nvdThird Party AdvisoryVDB Entry
exchange.xforce.ibmcloud.com/vulnerabilities/94814nvd
security.gentoo.org/glsa/201509-03nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000