CVE-2026-39948Disclosure(cacti / cacti)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Cacti is an open source performance and fault management framework. In versions 1.2.30 and prior, the rfilter request parameter is retrieved via the raw accessor grv() (rather than gfrv() with FILTER_VALIDATE_IS_REGEX validation) and concatenated directly into RLIKE SQL clauses in lib/html_graph.php and lib/html_tree.php, which are reachable pre-authentication through graph_view.php on installations with guest graph viewing enabled. Because the unbalanced-quote payload bypasses the regex validation that would otherwise reject it, an unauthenticated attacker can inject arbitrary SQL to compromise the confidentiality, integrity, and availability of the database. This advisory is similar to GHSA-69gg-mjfm-jjpc. This issue has been fixed in version 1.2.31.

cacti CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

Weakness type (CWE)

CWE-89

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

cacti

Threat summary

2 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-06-25); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

cacti

Products

cacti

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets4 URLs

By indicator

Full discourse2 posts

FOFA@fofabot86d
Disclosure
⚠️⚠️ CVE-2026-39893 (CVSS 9.8) + CVE-2026-39948 (CVSS 9.8) + CVE-2026-39955 (CVSS 9.8) + CVE-2026-39938 (CVSS 9.8): Pre-auth SQLi and LFI in Cacti <=1.2.30 via graph_view.php; guest graph viewing can expose unauthenticated paths. 🔗FOFA Link: https://en.fofa.info/result?qbase64=YXBwPSJDYWN0aS1Nb25pdG9yaW5nIg== 🎯16.8K+ Results are found on http://en.fofa.info in the past year. FOFA Query: app="Cacti-Monitoring" 🔖Refer: https://securityonline.info/cacti-vulnerabilities-1-2-31/ #OSINT #FOFA #CyberSecurity #Vulnerability
Post summary
The text announces four high‑severity CVEs affecting Cacti <=1.2.30, detailing pre‑authentication SQL injection and local file inclusion via graph_view.php, but it does not provide PoCs, patches, or evidence of active exploitation.
4270954014.7K
14.7K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds91d
Disclosure
CVE-2026-39948 SQL Injection in Cacti 1.2.30 and Prior via Unvalidated rfilter Parameter https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-39948
Post summary
A concise disclosure of a SQL injection flaw in Cacti 1.2.30 and earlier, triggered by an unchecked rfilter parameter; it reports no PoC, exploit, or patch details.
01010104
4.1K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	cacti	cacti	-	-	-

Explore more

Back to dashboard cacti CVEs cacti vulnerabilities