CVE-2018-10059

MEDIUM

Cacti < 1.1.36 - Cross-Site Scripting via get_current_page Function

Title source: llm

Description

Cacti before 1.1.37 has XSS because the get_current_page function in lib/functions.php relies on $_SERVER['PHP_SELF'] instead of $_SERVER['SCRIPT_NAME'] to determine a page name.

References (3)

Core 3

Core References

Exploit, Patch, Third Party Advisory x_refsource_misc

https://github.com/Cacti/cacti/issues/1457

Vendor Advisory x_refsource_misc

https://www.cacti.net/changelog.php

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1040620

Scores

CVSS v3 5.4

EPSS 0.0116

EPSS Percentile 64.0%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (1)

cacti/cacti < 1.1.36

Published Apr 12, 2018

Tracked Since Feb 18, 2026