CVE-2024-54146: Cacti is an open source performance and fault management framework. Cacti has a SQL injection vulnerability in the template function of host_templates.php…

PriorityP263high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

38.63%

98.4th percentile

Cacti is an open source performance and fault management framework. Cacti has a SQL injection vulnerability in the template function of host_templates.php using the graph_template parameter. This vulnerability is fixed in 1.2.29.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
cacti	cacti	< 1.2.29	1.2.29
cacti	cacti	<= 1.2.29	—
cacti	cacti	>= 0 < 1.2.28+ds1-4	1.2.28+ds1-4
cacti	cacti	>= 0 < 1.2.30+ds1-1	1.2.30+ds1-1
cacti	cacti	>= 0 < 1.2.28+ds1-4	1.2.28+ds1-4
cacti	cacti	>= 0 < 1.2.30+ds1-1	1.2.30+ds1-1
debian	cacti	< cacti 1.2.28+ds1-4 (forky)	cacti 1.2.28+ds1-4 (forky)
debian	cacti	< cacti 1.2.30+ds1-1 (forky)	cacti 1.2.30+ds1-1 (forky)

Detection & IOCsextracted from sources · hover to see the quote

→SQL injection vulnerability in Cacti's template function located in host_templates.php, triggered via the `graph_template` parameter ↗

·CVE-2024-54146 was only partially fixed in Cacti 1.2.29; the incomplete fix led to CVE-2025-26520, which covers the same injection point (host_templates.php / graph_template parameter). Full remediation requires upgrading to 1.2.30 or the Debian package 1.2.30+ds1-1. ↗
·Debian bookworm/bullseye resolutions for CVE-2024-54146 are marked resolved but the specific fixed package version is only explicitly stated for forky/sid/trixie (1.2.28+ds1-4); verify the exact package version for bookworm/bullseye environments. ↗

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

osv8.8HIGH

vendor_debian7.6LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.