X4Vak

The issue is a Stored Cross-Site-Scripting (XSS) vulnerability that allows an authenticated user to poison data. It is found in the `graphs new.php` file. Several validations are performed, but the `returnto` parameter is directly passed to `form save button`. To bypass this validation, `returnto` must contain `host.php`. This vulnerability can be exploited by a remote attacker using a specially crafted link.

An authenticated SQL injection issue was discovered in Cacti, an open source operational monitoring and fault management framework. This issue allows authenticated users to perform privilege escalation and remote code execution. The vulnerability is located in the `graphs.php` file and is related to the `ajax hosts` and `ajax hosts noany` functions. When the `site id` parameter is greater than 0, it is directly reflected in the WHERE clause of the SQL statement, creating an SQL injection vulnerability.

Cacti is an open source operational monitoring and fault management framework. A SQL injection vulnerability was discovered in graph view.php. Since guest users can access graph view.php without authentication by default, there could be potential for significant damage if guest users are being utilized in an enabled state. Attackers may exploit this vulnerability, potentially leading to actions such as the usurpation of administrative privileges or remote code execution.

A defect in the `sql save` function was discovered in Cacti, an open source operational monitoring and fault management framework. When the column type is numeric, the `sql save` function directly utilizes user input. Many files and functions calling the `sql save` function do not perform prior validation of user input, leading to the existence of multiple SQL injection vulnerabilities. This allows authenticated users to exploit these SQL injection vulnerabilities to perform privilege escalation and remote code execution.

An authenticated SQL injection issue allows authenticated users to perform privilege escalation and remote code execution. The issue resides in the `reports user.php` file, specifically in the `ajax get branches` function where the `tree id` parameter is passed to the `reports get branch select` function without validation.