High severity8.8NVD Advisory· Published Dec 22, 2023· Updated Jun 17, 2026
CVE-2023-51448
CVE-2023-51448
Description
Cacti provides an operational monitoring and fault management framework. Version 1.2.25 has a Blind SQL Injection (SQLi) vulnerability within the SNMP Notification Receivers feature in the file ‘managers.php’. An authenticated attacker with the “Settings/Utilities” permission can send a crafted HTTP GET request to the endpoint ‘/cacti/managers.php’ with an SQLi payload in the ‘selected_graphs_array’ HTTP GET parameter. As of time of publication, no patched versions exist.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
10cpe:2.3:a:cacti:cacti:1.2.25:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:cacti:cacti:1.2.25:*:*:*:*:*:*:*
- (no CPE)range: <1.2.25
- (no CPE)range: <= 1.2.25
- osv-coords7 versionspkg:rpm/opensuse/cacti&distro=openSUSE%20Leap%2015.5pkg:rpm/suse/cacti-spine&distro=SUSE%20Package%20Hub%2012pkg:rpm/suse/cacti&distro=SUSE%20Package%20Hub%2012pkg:rpm/suse/cacti-spine&distro=SUSE%20Package%20Hub%2015%20SP5pkg:rpm/opensuse/cacti-spine&distro=openSUSE%20Leap%2015.5pkg:rpm/opensuse/cacti&distro=openSUSE%20Tumbleweedpkg:rpm/suse/cacti&distro=SUSE%20Package%20Hub%2015%20SP5
< 1.2.26-bp155.2.6.1+ 6 more
- (no CPE)range: < 1.2.26-bp155.2.6.1
- (no CPE)range: < 1.2.26-bp155.2.6.1
- (no CPE)range: < 1.2.26-bp155.2.6.1
- (no CPE)range: < 1.2.26-bp155.2.6.1
- (no CPE)range: < 1.2.26-bp155.2.6.1
- (no CPE)range: < 1.2.26-1.1
- (no CPE)range: < 1.2.26-bp155.2.6.1
Patches
Vulnerability mechanics
References
3News mentions
0No linked articles in our index yet.