CVE-2024-43362

Cacti is an open source performance and fault management framework. The `fileurl` parameter is not properly sanitized when saving external links in `links.php` . Morever, the said fileurl is placed in some html code which is passed to the `print` function in `link.php` and `index.php`, finally leading to stored XSS. Users with the privilege to create external links can manipulate the `fileurl` parameter in the http post request while creating external links to perform stored XSS attacks. The vulnerability known as XSS (Cross-Site Scripting) occurs when an application allows untrusted user input to be displayed on a web page without proper validation or escaping. This issue has been addressed in release version 1.2.28. All users are advised to upgrade. There are no known workarounds for this issue.

• CWE-79

• https://github.com/Cacti/cacti/security/advisories/GHSA-wh9c-v56x-v77cExploit, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2025/02/msg00010.html

Published

Oct 7, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-43356Cross-Site Request Forgery (CSRF) vulnerability in bobbingwi…4.3
• CVE-2024-43357ECMA-262 is the language specification for the scripting lan…8.6
• CVE-2024-43358ZoneMinder is a free, open source closed-circuit television …6.1
• CVE-2024-43359ZoneMinder is a free, open source closed-circuit television …6.1
• CVE-2024-4336Adive Framework 2.0.8, does not sufficiently encode user-con…7.4
• CVE-2024-43360ZoneMinder is a free, open source closed-circuit television …9.8
• CVE-2024-43363Cacti is an open source performance and fault management fra…7.2
• CVE-2024-43364Cacti is an open source performance and fault management fra…8.2
• CVE-2024-43365Cacti is an open source performance and fault management fra…8.2
• CVE-2024-43366zkvyper is a Vyper compiler. Starting in version 1.3.12 and …9.1
• CVE-2024-43367Boa is an embeddable and experimental Javascript engine writ…7.5
• CVE-2024-43368The Trix editor, versions prior to 2.1.4, is vulnerable to X…6.5