CVE-2026-39900

5.3 mediumEPSS 0.3%

Medium (5.3) in cacti cacti. EPSS 0.3% chance of exploitation in the next 30 days.

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Reflected XSS via tab parameter in the auth_profile.php JavaScript context. This issue has been fixed in version 1.2.31.

Severity

CVSS 4.0

5.3 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 18% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2026-06-24
Modified: 2026-06-25
Record from: the NVD, synced 2026-10-19

Affected

cacti:cacti

References

https://github.com/Cacti/cacti/commit/891344a5c10b8687a3d2a5d26e6de20f13069e2a
https://github.com/Cacti/cacti/security/advisories/GHSA-34rf-frc3-v48r

Check your stack JSON