CVE-2024-43364

Cacti is an open source performance and fault management framework. The `title` parameter is not properly sanitized when saving external links in links.php . Morever, the said title parameter is stored in the database and reflected back to user in index.php, finally leading to stored XSS. Users with the privilege to create external links can manipulate the `title` parameter in the http post request while creating external links to perform stored XSS attacks. The vulnerability known as XSS (Cross-Site Scripting) occurs when an application allows untrusted user input to be displayed on a web page without proper validation or escaping. This issue has been addressed in release version 1.2.28. All users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-79

• https://github.com/Cacti/cacti/security/advisories/GHSA-fgc6-g8gc-wcg5Exploit, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2025/02/msg00010.html

Published

Oct 7, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-43358ZoneMinder is a free, open source closed-circuit television …6.1
• CVE-2024-43359ZoneMinder is a free, open source closed-circuit television …6.1
• CVE-2024-4336Adive Framework 2.0.8, does not sufficiently encode user-con…7.4
• CVE-2024-43360ZoneMinder is a free, open source closed-circuit television …9.8
• CVE-2024-43362Cacti is an open source performance and fault management fra…5.4
• CVE-2024-43363Cacti is an open source performance and fault management fra…7.2
• CVE-2024-43365Cacti is an open source performance and fault management fra…8.2
• CVE-2024-43366zkvyper is a Vyper compiler. Starting in version 1.3.12 and …9.1
• CVE-2024-43367Boa is an embeddable and experimental Javascript engine writ…7.5
• CVE-2024-43368The Trix editor, versions prior to 2.1.4, is vulnerable to X…6.5
• CVE-2024-43369Ibexa RichText Field Type is a Field Type for supporting ric…7.2
• CVE-2024-4337Adive Framework 2.0.8, does not sufficiently encode user-con…7.4