What’s Vulnerable › Vulnerabilities

CVE-2014-4000

• Severity: high (CVSS 8.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-11-15 · updated 2026-06-17
• Weakness: CWE-94

Description

Cacti before 1.0.0 allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object, related to calling unserialize(stripslashes()).

Affected products

• cacti: before 1.0.0 — fixed in 1.0.0

How to fix

Upgrade to a fixed version: cacti 1.0.0. Check the vendor advisory for mitigations.

References

• https://forums.cacti.net/viewtopic.php?f=4&t=56794
• https://security-tracker.debian.org/tracker/CVE-2014-4000
• https://security.gentoo.org/glsa/201711-10
• https://www.cacti.net/release_notes_1_0_0.php
• https://forums.cacti.net/viewtopic.php?f=4&t=56794
• https://security-tracker.debian.org/tracker/CVE-2014-4000
• https://security.gentoo.org/glsa/201711-10
• https://www.cacti.net/release_notes_1_0_0.php

Get alerted when CVE-2014-4000 or the next vulnerability affects your stack