CVE-2017-11691

Cross-site scripting (XSS) vulnerability in auth_profile.php in Cacti 1.1.13 allows remote attackers to inject arbitrary web script or HTML via specially crafted HTTP Referer headers.

• CWE-79

• http://www.securityfocus.com/bid/100022Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1038982Third Party Advisory, VDB Entry
• https://github.com/Cacti/cacti/commit/104090aeead4aa433bf1f18cd6d52dcfeb71236cPatch
• https://github.com/Cacti/cacti/issues/867Exploit, Third Party Advisory
• http://www.securityfocus.com/bid/100022Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1038982Third Party Advisory, VDB Entry
• https://github.com/Cacti/cacti/commit/104090aeead4aa433bf1f18cd6d52dcfeb71236cPatch
• https://github.com/Cacti/cacti/issues/867Exploit, Third Party Advisory

Published

Jul 27, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-11683There is a reachable assertion in the Internal::TiffReader::…6.5
• CVE-2017-11684There is an illegal address access in the build_table functi…
• CVE-2017-11685Multiple Reflective cross-site scripting (XSS) vulnerabiliti…
• CVE-2017-11686Zoho ManageEngine Event Log Analyzer 11.4 and 11.5 allows re…
• CVE-2017-11687Multiple Persistent cross-site scripting (XSS) vulnerabiliti…
• CVE-2017-1169IBM DOORS next Generation (DNG/RRC) is vulnerable to cross-s…
• CVE-2017-11692The function "Token& Scanner::peek" in scanner.cpp in yaml-c…
• CVE-2017-11693MEDHOST Document Management System contains hard-coded crede…
• CVE-2017-11694MEDHOST Document Management System contains hard-coded crede…
• CVE-2017-11695Heap-based buffer overflow in the alloc_segs function in lib…
• CVE-2017-11696Heap-based buffer overflow in the __hash_open function in li…
• CVE-2017-11697The __hash_open function in hash.c:229 in Mozilla Network Se…