Cacti Cross Site Scripting and HTML Injection Vulnerabilities
Cacti is prone to cross-site-scripting and HTML-injection
vulnerabilities because it fails to properly sanitize user-
supplied input before using it in dynamically generated content.
Attacker-supplied HTML and script code would run in the context
of the affected browser, potentially allowing the attacker to
steal cookie-based authentication credentials or to control how
the site is rendered to the user. Other attacks are also
possible.  Versions prior to Cacti 0.8.7g are vulnerable.
Privacy Statement Copyright 2010, SecurityFocus