QwikSec

Security Database

CVE

CWE

Training

CVE-2005-10004

Published: Aug 30, 2025

Modified: May 15, 2026

PUBLISHED

Description

Cacti versions prior to 0.8.6-d contain a remote command execution vulnerability in the graph_view.php script. An authenticated user can inject arbitrary shell commands via the graph_start GET parameter, which is improperly handled during graph rendering. This flaw allows attackers to execute commands on the underlying operating system with the privileges of the web server process, potentially compromising system integrity.

Vendor	Product	Versions
Raxnet/Ian Berry	Cacti	affected `0 - < 0.8.6-d`

Weaknesses (CWE)

References

https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/cacti_graphimage_exec.rb

exploit

https://www.exploit-db.com/exploits/9911

exploit

https://www.exploit-db.com/exploits/16881

exploit

https://www.cacti.net/info/downloads

product

https://web.archive.org/web/20050305034552/http://www.cacti.net/cactid_download.php

product

patch

https://www.vulncheck.com/advisories/cacti-graph-view-rce

third-party-advisory

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.