CVE-2026-39900

Name of the Vulnerable Software and Affected Versions Cacti versions prior to 1.2.31

Description Reflected Cross-Site Scripting (XSS) occurs in the JavaScript context of the 'auth profile.php' endpoint through the tab parameter. Reflected XSS is a type of attack where a malicious script is reflected off a web application to the victim's browser.

Recommendations Update to version 1.2.31. As a temporary workaround, restrict access to the 'auth profile.php' endpoint or avoid using the tab parameter until the update is applied.