Jpgjpgjpgjpg

**Name of the Vulnerable Software and Affected Versions** Cacti versions prior to 1.2.31 **Description** An issue exists in the performance and fault management framework where improper handling of deserialized data leads to SQL Injection. In the 'managers.php' file, the application processes the `selected graphs array` variable using a custom unserialize function. While object injection is prevented, arbitrary string arrays can still be deserialized. These values are subsequently passed to the `db execute()` function and merged into a SQL DELETE statement via an implode operation without integer validation. This allows for SQL Injection when utilizing SNMP agent management permissions. **Recommendations** Update to version 1.2.31.

**Name of the Vulnerable Software and Affected Versions** GLPI versions 11.0.0 through 11.0.4 **Description** A GLPI administrator can perform Server-Side Request Forgery (SSRF) requests through the Webhook feature. This allows an attacker to potentially make requests on behalf of the server, accessing internal resources or performing actions with the server's privileges. **Recommendations** Update to version 11.0.5 or later.