There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Cacti is an open source operational monitoring and fault management framework. Affected versions are
    subject to a SQL injection discovered in graph_view.php. Since guest users can access graph_view.php
    without authentication by default, if guest users are being utilized in an enabled state, there could be
    the potential for significant damage. Attackers may exploit this vulnerability, and there may be
    possibilities for actions such as the usurpation of administrative privileges or remote code execution.
    This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known
    workarounds for this vulnerability. (CVE-2023-39361)

  - Cacti is an open source operational monitoring and fault management framework. There are two instances of
    insecure deserialization in Cacti version 1.2.24. While a viable gadget chain exists in Cacti’s vendor
    directory (phpseclib), the necessary gadgets are not included, making them inaccessible and the insecure
    deserializations not exploitable. Each instance of insecure deserialization is due to using the
    unserialize function without sanitizing the user input. Cacti has a “safe” deserialization that attempts
    to sanitize the content and check for specific values before calling unserialize, but it isn’t used in
    these instances. The vulnerable code lies in graphs_new.php, specifically within the host_new_graphs_save
    function. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no
    known workarounds for this vulnerability. (CVE-2023-30534)

  - Cacti is an open source operational monitoring and fault management framework. A defect in the sql_save
    function was discovered. When the column type is numeric, the sql_save function directly utilizes user
    input. Many files and functions calling the sql_save function do not perform prior validation of user
    input, leading to the existence of multiple SQL injection vulnerabilities in Cacti. This allows
    authenticated users to exploit these SQL injection vulnerabilities to perform privilege escalation and
    remote code execution. This issue has been addressed in version 1.2.25. Users are advised to upgrade.
    There are no known workarounds for this vulnerability. (CVE-2023-39357)

  - Cacti is an open source operational monitoring and fault management framework. An authenticated SQL
    injection vulnerability was discovered which allows authenticated users to perform privilege escalation
    and remote code execution. The vulnerability resides in the `reports_user.php` file. In
    `ajax_get_branches`, the `tree_id` parameter is passed to the `reports_get_branch_select` function without
    any validation. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are
    no known workarounds for this vulnerability. (CVE-2023-39358)

  - Cacti is an open source operational monitoring and fault management framework. An authenticated SQL
    injection vulnerability was discovered which allows authenticated users to perform privilege escalation
    and remote code execution. The vulnerability resides in the `graphs.php` file. When dealing with the cases
    of ajax_hosts and ajax_hosts_noany, if the `site_id` parameter is greater than 0, it is directly reflected
    in the WHERE clause of the SQL statement. This creates an SQL injection vulnerability. This issue has been
    addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this
    vulnerability. (CVE-2023-39359)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - Cacti v1.2.25 中的 SQL 插入弱點允許遠端攻擊者透過 manager.php 函式中的 form_actions() 函式取得敏感資訊。 (CVE-2023-46490)

請注意，Nessus 依賴供應商報告的套件存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - Cacti v1.2.25 中的 SQL 注入漏洞允许远程攻击者通过 managers.php 函数中的 form_actions() 函数获取敏感信息。 (CVE-2023-46490)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - Cacti v1.2.25 の SQL インジェクションの脆弱性により、リモートの攻撃者が、manager.php 関数の form_actions() 関数を介して機密情報を取得する可能性があります。 （CVE-2023-46490）

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - SQL Injection vulnerability in Cacti v1.2.25 allows a remote attacker to obtain sensitive information via     the form_actions() function in the managers.php function. (CVE-2023-46490)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
427137	Alpine: multiple cacti packages: security update to 1.2.26-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	5/16/2025	11/4/2025	critical
408249	Alpine: multiple cacti packages: security update to 1.2.26-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	1/22/2024	7/2/2026	critical
408249	Alpine: multiple cacti packages: security update to 1.2.26-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	1/22/2024	7/2/2026	critical
427137	Alpine: multiple cacti packages: security update to 1.2.26-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	5/16/2025	11/4/2025	critical
226925	Linux Distros 未修補弱點：CVE-2023-46490	Nessus	Misc.	3/5/2025	9/2/2026	medium
226925	Linux Distros 未修补的漏洞: CVE-2023-46490	Nessus	Misc.	3/5/2025	9/2/2026	medium
226925	Linux Distros のパッチ未適用の脆弱性: CVE-2023-46490	Nessus	Misc.	3/5/2025	9/2/2026	medium
226925	Linux Distros Unpatched Vulnerability : CVE-2023-46490	Nessus	Misc.	3/5/2025	9/2/2026	medium

Detections

Analytics

Plugins Search

critical

critical

critical

critical

medium

medium

medium

medium