CVE-2023-49085

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Cacti provides an operational monitoring and fault management framework. In versions 1.2.25 and prior, it is possible to execute arbitrary SQL code through the `pollers.php` script. An authorized user may be able to execute arbitrary SQL code. The vulnerable component is the `pollers.php`. Impact of the vulnerability - arbitrary SQL code execution. As of time of publication, a patch does not appear to exist.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Cacti	cacti	<= 1.2.25

References

Timeline

Published: Dec 22, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-490865.4Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). A vulnerability in v CVE-2023-490877.5xml-security is a library that implements XML signatures and encryption. Validation of an XML signature requires verification that the hash CVE-2023-490884.8Cacti is an open source operational monitoring and fault management framework. The fix applied for CVE-2023-39515 in version 1.2.25 is incom CVE-2023-490896.5Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.0, Backoffi CVE-2023-49094.3Inappropriate implementation in Interstitials in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to obfuscate security UI via CVE-2023-490906.1CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. CarrierWave has a Content-Type allowlist bypass CVE-2023-490919.8Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Co CVE-2023-490925.9RustCrypto/RSA is a portable RSA implementation in pure Rust. Due to a non-constant-time implementation, information about the private key i CVE-2023-490938.8HtmlUnit is a GUI-less browser for Java programs. HtmlUnit is vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker CVE-2023-490944.3Symbolicator is a symbolication service for native stacktraces and minidumps with symbol server support. An attacker could make Symbolicator CVE-2023-490957.5nexkey is a microblogging platform. Insufficient validation of ActivityPub requests received in inbox could allow any user to impersonate an CVE-2023-490968.8Jellyfin is a Free Software Media System for managing and streaming media. In affected versions there is an argument injection in the Videos