VULNERABILITY INTELLIGENCE

CVE-2021-23225

CVSS score5.4 MEDIUM

EPSS probability0.53%

CISA KEVNot currently listed

Published2022-01-19

Last modified2026-06-17

Description

Cacti 1.1.38 allows authenticated users with User Management permissions to inject arbitrary web script or HTML in the "new_username" field during creation of a new user via "Copy" method at user_admin.php.