PT-2026-52135 · Cacti · Cacti

Published 2026-06-24 · Updated 2026-06-24 · CVE-2026-39900

NVD

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Reflected XSS via tab parameter in the auth profile.php JavaScript context. This issue has been fixed in version 1.2.31.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-39900

Affected Products

Cacti

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-39900 · Security Note
• https://github.com/Cacti/cacti/security/advisories/GHSA-34rf-frc3-v48r · Note
• https://github.com/Cacti/cacti/commit/891344a5c10b8687a3d2a5d26e6de20f13069e2a · Note