CVE-2025-45160 — Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in Cacti

CWE-80 — Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)5 documents5 sources
Severity
5.4MEDIUMNVD
EPSS
0.0%
top 97.43%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
CactiDebian Cacti
Timeline
PublishedJan 29

Description

A HTML injection vulnerability exists in the file upload functionality of Cacti , , ) into the rendered page. NOTE: Multiple third-parties including the maintainer have stated that they cannot reproduce this issue after 1.2.27.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.5

Affected Packages2 packages

▶debiandebian/cacti< cacti 1.2.24+ds1-1+deb12u3 (bookworm)
▶Debiancacti/cacti< 1.2.24+ds1-1+deb12u3+2

🔴Vulnerability Details

2
OSV
CVE-2025-45160: A HTML injection vulnerability exists in the file upload functionality of Cacti , , ) into the rendered page↗2026-01-29
▶
GHSA
GHSA-fxgp-4f5f-c9fc: A HTML injection vulnerability exists in the file upload functionality of Cacti , , ) into the rendered page↗2026-01-29
▶

📋Vendor Advisories

1
Debian
CVE-2025-45160: cacti - A HTML injection vulnerability exists in the file upload functionality of Cacti ...↗2025
▶

🕵️Threat Intelligence

1
Wiz
CVE-2025-45160 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶