{"id":"CVE-2019-17357","url":"https://www.cyber-defence.io/tools/cve/CVE-2019-17357","generatedAt":"2026-11-05T02:25:56.778Z","title":"Cacti through 1.2.7 is affected by a graphs.php?template_id= SQL injection vulnerability affecting how template identifiers are handled when a string and id composite value are used to identify the template type and id.","description":"Cacti through 1.2.7 is affected by a graphs.php?template_id= SQL injection vulnerability affecting how template identifiers are handled when a string and id composite value are used to identify the template type and id. An authenticated attacker can exploit this to extract data from the database, or an unauthenticated remote attacker could exploit this via Cross-Site Request Forgery.","published":"2020-01-21T19:15:13.000Z","lastModified":"2026-06-17T02:23:48.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.1","score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},"cwe":["CWE-89"],"affected":["cacti/cacti"],"epss":{"score":0.3424,"percentile":0.98408,"date":"2026-11-03","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 34.2%, higher than 98% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html","source":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html","source":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html","source":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html","source":"cve@mitre.org"},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=947374","tags":["Issue Tracking","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://github.com/Cacti/cacti/issues/3025","tags":["Patch","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://security.gentoo.org/glsa/202003-40","source":"cve@mitre.org"},{"url":"https://www.darkmatter.ae/xen1thlabs/","tags":["Broken Link"],"source":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=947374","tags":["Issue Tracking","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/Cacti/cacti/issues/3025","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/202003-40","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.darkmatter.ae/xen1thlabs/","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-17357","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}