CVE-2023-51448

Cacti provides an operational monitoring and fault management framework. Version 1.2.25 has a Blind SQL Injection (SQLi) vulnerability within the SNMP Notification Receivers feature in the file `‘managers.php’`. An authenticated attacker with the “Settings/Utilities” permission can send a crafted HTTP GET request to the endpoint `‘/cacti/managers.php’` with an SQLi payload in the `‘selected_graphs_array’` HTTP GET parameter. As of time of publication, no patched versions exist.

• CWE-89

• https://github.com/Cacti/cacti/blob/5f6f65c215d663a775950b2d9db35edbaf07d680/managers.php#L941Exploit, Vendor Advisory
• https://github.com/Cacti/cacti/security/advisories/GHSA-w85f-7c4w-7594Exploit, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/
• https://github.com/Cacti/cacti/blob/5f6f65c215d663a775950b2d9db35edbaf07d680/managers.php#L941Exploit, Vendor Advisory
• https://github.com/Cacti/cacti/security/advisories/GHSA-w85f-7c4w-7594Exploit, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/

Published

Dec 22, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-51442Navidrome is an open source web-based music collection serve…8.6
• CVE-2023-51443FreeSWITCH is a Software Defined Telecom Stack enabling the …5.9
• CVE-2023-51444GeoServer is an open source software server written in Java …7.2
• CVE-2023-51445GeoServer is an open source software server written in Java …4.8
• CVE-2023-51446GLPI is a Free Asset and IT Management Software package. Whe…8.1
• CVE-2023-51447Decidim is a participatory democracy framework. Starting in …5.4
• CVE-2023-51449Gradio is an open-source Python package that allows you to q…7.5
• CVE-2023-5145** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been fou…8.8
• CVE-2023-51450baserCMS is a website development framework. Prior to versio…8.1
• CVE-2023-51451Symbolicator is a service used in Sentry. Starting in Symbol…4.3
• CVE-2023-51452A Improper Input Validation issue affecting the v2_sdk_servi…3
• CVE-2023-51453A Improper Input Validation issue affecting the v2_sdk_servi…3