CVE-2020-35701

An issue was discovered in Cacti 1.2.x through 1.2.16. A SQL injection vulnerability in data_debug.php allows remote authenticated attackers to execute arbitrary SQL commands via the site_id parameter. This can lead to remote code execution.

• CWE-89

• https://asaf.me/2020/12/15/cacti-1-2-0-to-1-2-16-sql-injection/Exploit, Third Party Advisory
• https://github.com/Cacti/cacti/issues/4022Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6DDD22Z56THHDTXAFM447UH3BVINURIF/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C7DPUWZBAMCXFKAKUAJSHL3CKTOLGAK6/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NBKBR2MFZJ6C2I4I5PCRR6UERPY24XZN/
• https://security.gentoo.org/glsa/202101-31Third Party Advisory
• https://asaf.me/2020/12/15/cacti-1-2-0-to-1-2-16-sql-injection/Exploit, Third Party Advisory
• https://github.com/Cacti/cacti/issues/4022Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6DDD22Z56THHDTXAFM447UH3BVINURIF/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C7DPUWZBAMCXFKAKUAJSHL3CKTOLGAK6/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NBKBR2MFZJ6C2I4I5PCRR6UERPY24XZN/
• https://security.gentoo.org/glsa/202101-31Third Party Advisory

Published

Jan 11, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-35686The SECOMN service in Sound Research DCHU model software com…7.8
• CVE-2020-35687PHPFusion version 9.03.90 is vulnerable to CSRF attack which…4.3
• CVE-2020-3569Multiple vulnerabilities in the Distance Vector Multicast Ro…8.6
• CVE-2020-35693On some Samsung phones and tablets running Android through 7…8.8
• CVE-2020-35698Thinkific Thinkific Online Course Creation Platform 1.0 is a…6.1
• CVE-2020-35700A second-order SQL injection issue in Widgets/TopDevicesCont…8.8
• CVE-2020-35702DCTStream::getChars in DCTStream.cc in Poppler 20.12.1 has a…7.8
• CVE-2020-35704Daybyday 2.1.0 allows stored XSS via the Title parameter to …5.4
• CVE-2020-35705Daybyday 2.1.0 allows stored XSS via the Name parameter to t…5.4
• CVE-2020-35706Daybyday 2.1.0 allows stored XSS via the Title parameter to …5.4
• CVE-2020-35707Daybyday 2.1.0 allows stored XSS via the Company Name parame…5.4
• CVE-2020-35708phpList 3.5.9 allows SQL injection by admins who provide a c…7.2