CVE-2023-49084

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). While using the detected SQL Injection and insufficient processing of the include file path, it is possible to execute arbitrary code on the server. Exploitation of the vulnerability is possible for an authorized user. The vulnerable component is the `link.php`. Impact of the vulnerability execution of arbitrary code on the server.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-98

Affected software

No affected versions have been published.

Timeline

Published: Dec 21, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-490858.8Cacti provides an operational monitoring and fault management framework. In versions 1.2.25 and prior, it is possible to execute arbitrary S CVE-2023-490865.4Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). A vulnerability in v CVE-2023-490877.5xml-security is a library that implements XML signatures and encryption. Validation of an XML signature requires verification that the hash CVE-2023-490884.8Cacti is an open source operational monitoring and fault management framework. The fix applied for CVE-2023-39515 in version 1.2.25 is incom CVE-2023-490896.5Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.0, Backoffi CVE-2023-49094.3Inappropriate implementation in Interstitials in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to obfuscate security UI via CVE-2023-490906.1CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. CarrierWave has a Content-Type allowlist bypass CVE-2023-490919.8Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Co CVE-2023-490925.9RustCrypto/RSA is a portable RSA implementation in pure Rust. Due to a non-constant-time implementation, information about the private key i CVE-2023-490938.8HtmlUnit is a GUI-less browser for Java programs. HtmlUnit is vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker CVE-2023-490944.3Symbolicator is a symbolication service for native stacktraces and minidumps with symbol server support. An attacker could make Symbolicator CVE-2023-490957.5nexkey is a microblogging platform. Insufficient validation of ActivityPub requests received in inbox could allow any user to impersonate an