CVE-2014-5026

Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote authenticated users with console access to inject arbitrary web script or HTML via a (1) Graph Tree Title in a delete or (2) edit action; (3) CDEF Name, (4) Data Input Method Name, or (5) Host Templates Name in a delete action; (6) Data Source Title; (7) Graph Title; or (8) Graph Template Name in a delete or (9) duplicate action.

• CWE-79

• http://bugs.cacti.net/view.php?id=2456Issue Tracking, Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2015-03/msg00034.htmlThird Party Advisory
• http://seclists.org/oss-sec/2014/q3/244Exploit, Third Party Advisory, VDB Entry
• http://www.debian.org/security/2014/dsa-3007Third Party Advisory
• http://www.openwall.com/lists/oss-security/2014/07/22/9Exploit, Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/68759Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/94816
• https://security.gentoo.org/glsa/201509-03
• http://bugs.cacti.net/view.php?id=2456Issue Tracking, Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2015-03/msg00034.htmlThird Party Advisory
• http://seclists.org/oss-sec/2014/q3/244Exploit, Third Party Advisory, VDB Entry
• http://www.debian.org/security/2014/dsa-3007Third Party Advisory
• http://www.openwall.com/lists/oss-security/2014/07/22/9Exploit, Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/68759Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/94816
• https://security.gentoo.org/glsa/201509-03

Published

Oct 20, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-5020The File module in Drupal 7.x before 7.29 does not properly …
• CVE-2014-5021Cross-site scripting (XSS) vulnerability in the Form API in …
• CVE-2014-5022Cross-site scripting (XSS) vulnerability in the Ajax system …
• CVE-2014-5023Repository.php in Gitter, as used in Gitlist, allows remote …
• CVE-2014-5024Cross-site scripting (XSS) vulnerability in sgms/panelManage…
• CVE-2014-5025Cross-site scripting (XSS) vulnerability in data_sources.php…
• CVE-2014-5027Cross-site scripting (XSS) vulnerability in Review Board 1.7…
• CVE-2014-5028The Original File and Patched File resources in Review Board…
• CVE-2014-5029The web interface in CUPS 1.7.4 allows local users in the lp…
• CVE-2014-5030CUPS before 2.0 allows local users to read arbitrary files v…
• CVE-2014-5031The web interface in CUPS before 2.0 does not check that fil…
• CVE-2014-5032GLPI before 0.84.7 does not properly restrict access to cost…