https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 06:14:33 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-349678 EUVD-2026-349678 https://cve.radiocsirt.org/vuln/euvd-2026-349678 https://cve.radiocsirt.org/vuln/fkie_cve-2026-71287 <p>Cacti&#39;s sanitize_sql_column (lib/functions.php) sanitizes user-supplied ORDER BY column names using the regex . Because this allowlist retains letters, digits, underscore, parentheses, and dot (intended to support expressions like COUNT(id) and table.column), a payload such as passes through completely unmodified.</p> <p>Cacti&#39;s sanitize_sql_column (lib/functions.php) sanitizes user-supplied ORDER BY column names using the regex . Because this allowlist retains letters, digits, underscore, parentheses, and dot (intended to support expressions like COUNT(id) and table.column), a payload such as passes through completely unmodified.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-71287 https://cve.radiocsirt.org/vuln/ghsa-7v66-c77r-g454 <p>Cacti&#39;s sanitize_sql_column() (lib/functions.php) sanitizes user-supplied ORDER BY column names using the regex `preg_replace(&#39;/[^a-zA-Z0-9_().]/&#39;, &#39;&#39;, $column)`. Because this allowlist retains letters, digits, underscore, parentheses, and dot (intended to support expressions like COUNT(id) and table.column), a payload such as `SLEEP(5)` passes through completely unmodified. The sanitized value is concatenated directly into raw SQL ORDER BY clauses (which cannot be parameterized) driven by a `sort_column` GET parameter in at least user_log.php, utilities.php, user_domains.php, and user_group_admin.php, allowing any authenticated Cacti user, regardless of privilege level, to perform time-based blind SQL injection against the Cacti database.</p> <p>Cacti&#39;s sanitize_sql_column() (lib/functions.php) sanitizes user-supplied ORDER BY column names using the regex `preg_replace(&#39;/[^a-zA-Z0-9_().]/&#39;, &#39;&#39;, $column)`. Because this allowlist retains letters, digits, underscore, parentheses, and dot (intended to support expressions like COUNT(id) and table.column), a payload such as `SLEEP(5)` passes through completely unmodified. The sanitized value is concatenated directly into raw SQL ORDER BY clauses (which cannot be parameterized) driven by a `sort_column` GET parameter in at least user_log.php, utilities.php, user_domains.php, and user_group_admin.php, allowing any authenticated Cacti user, regardless of privilege level, to perform time-based blind SQL injection against the Cacti database.</p> https://cve.radiocsirt.org/vuln/ghsa-7v66-c77r-g454 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-71287 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: cacti, Ubuntu:Pro:16.04:LTS: cacti, Ubuntu:Pro:18.04:LTS: cacti, Ubuntu:Pro:20.04:LTS: cacti, Ubuntu:Pro:22.04:LTS: cacti, Ubuntu:24.04:LTS: cacti, Ubuntu:26.04:LTS: cacti</p> <p>Cacti&#39;s sanitize_sql_column (lib/functions.php) sanitizes user-supplied ORDER BY column names using the regex . Because this allowlist retains letters, digits, underscore, parentheses, and dot (intended to support expressions like COUNT(id) and table.column), a payload such as passes through completely unmodified.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: cacti, Ubuntu:Pro:16.04:LTS: cacti, Ubuntu:Pro:18.04:LTS: cacti, Ubuntu:Pro:20.04:LTS: cacti, Ubuntu:Pro:22.04:LTS: cacti, Ubuntu:24.04:LTS: cacti, Ubuntu:26.04:LTS: cacti</p> <p>Cacti&#39;s sanitize_sql_column (lib/functions.php) sanitizes user-supplied ORDER BY column names using the regex . Because this allowlist retains letters, digits, underscore, parentheses, and dot (intended to support expressions like COUNT(id) and table.column), a payload such as passes through completely unmodified.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-71287 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2684 <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Cacti ausnutzen, um einen SQL-Injection Angriff durchzuführen.</p> <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Cacti ausnutzen, um einen SQL-Injection Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2684