CVE-2024-31458

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in `form_save()` function in `graph_template_inputs.php` is not thoroughly checked and is used to concatenate the SQL statement in `draw_nontemplated_fields_graph_item()` function from `lib/html_form_templates.php` , finally resulting in SQL injection. Version 1.2.27 contains a patch for the issue.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: May 14, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-314597.2Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, there is a file inclusion issue in the `li CVE-2024-31464.3A vulnerability classified as problematic has been found in DedeCMS 5.7. This affects an unknown part of the file /src/dede/makehtml_rss_act CVE-2024-314608.8Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in `automation_tre CVE-2024-314619.1Plane, an open-source project management tool, has a Server-Side Request Forgery (SSRF) vulnerability in versions prior to 0.17-dev. This is CVE-2024-314626.3stable-diffusion-webui is a web interface for Stable Diffusion, implemented using Gradio library. Stable-diffusion-webui 1.7.0 is vulnerable CVE-2024-314634.7Ironic-image is an OpenStack Ironic deployment packaged and configured by Metal3. When the reverse proxy mode is enabled by the `IRONIC_REVE CVE-2024-314644.9XWiki Platform is a generic wiki platform. Starting in version 5.0-rc-1 and prior to versions 14.10.19, 15.5.4, and 15.9-rc-1, it is possibl CVE-2024-314658.8XWiki Platform is a generic wiki platform. Starting in version 5.0-rc-1 and prior to versions 14.10.20, 15.5.4, and 15.9-rc-1, any user with CVE-2024-314669.8There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending CVE-2024-314679.8There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending CVE-2024-314689.8There are buffer overflow vulnerabilities in the underlying Central Communications service that could lead to unauthenticated remote code ex CVE-2024-314699.8There are buffer overflow vulnerabilities in the underlying Central Communications service that could lead to unauthenticated remote code ex