Lorexxar

Cacti is an open source performance and fault management framework. It has a SQL injection vulnerability in the `get discovery results` function of `automation devices.php` using the `network` parameter. This vulnerability may allow a remote attacker to execute arbitrary code.

Cacti is an open source performance and fault management framework. It has a SQL injection vulnerability in the template function of host templates.php using the `graph template` parameter. This issue allows a remote attacker to execute arbitrary code due to inadequate protection of the SQL query structure.

The issue is related to a lack of protection for the web page structure, allowing a remote attacker to impact data integrity. It involves a Cross Site Scripting (XSS) issue, where an attacker can exploit the vulnerability through the database host and user in the /installer/test.php endpoint.

The issue is related to insufficient protection measures for web page structures in Roundcube Webmail, allowing a remote attacker to impact data integrity. The problem is specifically with the `username` template object in `include/rcmail output html.php`, which allows for XSS attacks.

The issue is related to insufficient protection measures for web page structures in Roundcube Webmail, allowing a remote attacker to impact data integrity. There is a Cross-Site Scripting (XSS) vulnerability via a malicious XML attachment, as text/xml is among the allowed types for a preview.

The issue allows remote PHP code execution due to a race condition in the `plupload action` function before deleting a file associated with the `name` parameter in `/wp-content/plugins/updraftplus/admin.php`. The vendor reports that this does not cross a privilege boundary.

The issue concerns a Server-Side Request Forgery (SSRF) in the `updraft ajax handler` function, located in `/wp-content/plugins/updraftplus/admin.php`, which can be exploited via an `httpget` subaction. The vendor has noted that this issue does not cross a privilege boundary.

The issue concerns a Cross Site Scripting (XSS) problem. It is located in the controllers/api.php file via the function parameter in a "c=api&m=data2" request.

The issue concerns remote PHP code execution via the `param` parameter in an "action=cache" request to "libraries/Template.php", which is an example of Eval Injection.

The issue concerns a Cross Site Scripting (XSS) problem. It occurs in the admin/Login.php file when a specific payload is entered into the `username` field, provided the payload does not start with a '<' character.

The issue concerns a SQL Injection flaw. It can be exploited via the `num` parameter in requests to "libraries/Template.php" with either "action=related" or "action=tags".

The issue is related to SQL Injection, which can be exploited via the `catid` parameter in an "action=related" request to the "libraries/Template.php" endpoint.

The issue concerns a SQL Injection flaw. It can be exploited via the `field` parameter in requests to "libraries/Template.php" with specific actions such as "module", "member", "form", or "related".

The issue concerns URL Redirector Abuse via the `url` parameter in a sync action, related to the controllers/Weixin.php file.

The issue allows for XSS in visitors.php due to the lack of restriction on JavaScript in visited URLs, both during logging and when reading logs.

The issue allows remote authenticated admins to conduct XSS attacks by uploading an image via a route=images action in the application/core/controller/images.php file.

A SQL Injection issue exists via the `visitor ip` parameter in the application/core/controller/excludes.php file.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the `folder`, `id`, or `name` parameter in the `/application/lib/ajax/get image.php` API endpoint.

The issue concerns a security problem where an attacker can execute malicious scripts. This is possible due to improper validation of user input in the `rangestart` and `rangeend` parameters on the "wps referrers page" page.