Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-7m68-seeq-tuae
Vulnerability ID VCID-7m68-seeq-tuae
Aliases CVE-2025-24368
Summary Cacti is an open source performance and fault management framework. Some of the data stored in automation_tree_rules.php is not thoroughly checked and is used to concatenate the SQL statement in build_rule_item_filter() function from lib/api_automation.php, resulting in SQL injection. This vulnerability is fixed in 1.2.29.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
System Score Found at
epss 0.00069 https://api.first.org/data/v1/epss?cve=CVE-2025-24368
epss 0.00069 https://api.first.org/data/v1/epss?cve=CVE-2025-24368
epss 0.00112 https://api.first.org/data/v1/epss?cve=CVE-2025-24368
epss 0.00112 https://api.first.org/data/v1/epss?cve=CVE-2025-24368
epss 0.00112 https://api.first.org/data/v1/epss?cve=CVE-2025-24368
epss 0.00112 https://api.first.org/data/v1/epss?cve=CVE-2025-24368
epss 0.00112 https://api.first.org/data/v1/epss?cve=CVE-2025-24368
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2025-24368
cvssv4 6.9 https://github.com/Cacti/cacti/commit/c7e4ee798d263a3209ae6e7ba182c7b65284d8f0
ssvc Track https://github.com/Cacti/cacti/commit/c7e4ee798d263a3209ae6e7ba182c7b65284d8f0
cvssv4 6.9 https://github.com/Cacti/cacti/security/advisories/GHSA-f9c7-7rc3-574c
ssvc Track https://github.com/Cacti/cacti/security/advisories/GHSA-f9c7-7rc3-574c
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2025-24368
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-24368
1094574 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1094574
c7e4ee798d263a3209ae6e7ba182c7b65284d8f0 https://github.com/Cacti/cacti/commit/c7e4ee798d263a3209ae6e7ba182c7b65284d8f0
GHSA-f9c7-7rc3-574c https://github.com/Cacti/cacti/security/advisories/GHSA-f9c7-7rc3-574c
No exploits are available.
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N Found at https://github.com/Cacti/cacti/commit/c7e4ee798d263a3209ae6e7ba182c7b65284d8f0
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-01-27T18:53:31Z/ Found at https://github.com/Cacti/cacti/commit/c7e4ee798d263a3209ae6e7ba182c7b65284d8f0
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N Found at https://github.com/Cacti/cacti/security/advisories/GHSA-f9c7-7rc3-574c
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-01-27T18:53:31Z/ Found at https://github.com/Cacti/cacti/security/advisories/GHSA-f9c7-7rc3-574c
Exploit Prediction Scoring System (EPSS)
Percentile 0.21335
EPSS Score 0.00069
Published At April 2, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T16:38:30.914061+00:00 Debian Oval Importer Import https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 38.0.0