CVE-2026-39900
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk18th percentile — higher than 18% of all known CVEs
Summary
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Reflected XSS via tab parameter in the auth_profile.php JavaScript context. This issue has been fixed in version 1.2.31.
Risk Assessment
Exploitation of this vulnerability may lead to session hijacking or injection of malicious code, posing a threat to the application's security and user data.
Recommendation
It is recommended to upgrade Cacti to version 1.2.31 or later to mitigate this vulnerability.
Original NVD description (English source)
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Reflected XSS via tab parameter in the auth_profile.php JavaScript context. This issue has been fixed in version 1.2.31.