CVE-2014-4000

8.8 highEPSS 1.7%

Cacti before 1.0.0 allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object, related to calling unserialize(stripslashes()).

Severity

CVSS 3.0

8.8 high

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.7% chance of exploitation in the next 30 days; higher than 76% of CVEs (scores of 2026-10-31)
CWE: CWE-94
Published: 2017-11-15
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

cacti:cacti

References

https://forums.cacti.net/viewtopic.php?f=4&t=56794
https://security-tracker.debian.org/tracker/CVE-2014-4000
https://security.gentoo.org/glsa/201711-10
https://www.cacti.net/release_notes_1_0_0.php
https://forums.cacti.net/viewtopic.php?f=4&t=56794

Check your stack JSON