CVE-2023-49085 - CVE House
Back to Database
Status published High CVE-2023-49085

Cacti SQL Injection vulnerability

Vulnerability Description

Cacti provides an operational monitoring and fault management framework. In versions 1.2.25 and prior, it is possible to execute arbitrary SQL code through the `pollers.php` script. An authorized user may be able to execute arbitrary SQL code. The vulnerable component is the `pollers.php`. Impact of the vulnerability - arbitrary SQL code execution. As of time of publication, a patch does not appear to exist.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-49085

Credits & Attribution

No credits recorded in the NVD database.

References

More from Cacti

View All →
CVE-2025-66399
SNMP Command Injection leads to RCE in Cacti
High 7.4
CVE-2025-26520
Cacti through 1.2.29 allows SQL injection in the template function...
High 7.6
CVE-2025-24368
Cacti has a SQL Injection vulnerability when using tree rules through Automation API
Medium 6.9
CVE-2025-24367
Cacti allows Arbitrary File Creation leading to RCE
High 8.7
CVE-2025-22604
Cacti has Authenticated RCE via multi-line SNMP responses
Critical 9.1

Affected Vendor

Affected Software

cacti
Vulnerable Versions:
<= 1.2.25

Timeline

Official Publish: December 22nd, 2023
Last Modified: February 25th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-89

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1213.006 Databases
Collection
T1485 Data Destruction
Impact