CVE-2017-10970

Severity: medium (CVSS 5.4 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-07-06 · updated 2026-06-17
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in link.php in Cacti 1.1.12 allows remote anonymous users to inject arbitrary web script or HTML via the id parameter, related to the die_html_input_error function in lib/html_validate.php.

Affected products

cacti: 1.1.12

References

http://www.securitytracker.com/id/1038908
https://github.com/Cacti/cacti/issues/838
http://www.securitytracker.com/id/1038908
https://github.com/Cacti/cacti/issues/838

Get alerted when CVE-2017-10970 or the next vulnerability affects your stack