Sploitus

CVE-2020-14295

10 known exploits for CVE-2020-14295

A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries.

Affected products
Cacti, Linuxmint, Suse, Ubuntu
Cacti
= 1.2.12
Fix
Available
CVSS 3.1
7.2 HIGH
EPSS
86.3% (100th percentile)
Weakness
CWE-89
NVD status
Modified
Published
2020-06-17
CVE-2020-14295 at NVD
Authoritative description, scoring and affected products

10 known exploits for CVE-2020-14295

Proof-of-concept code and exploit modules indexed by Sploitus

CVE-2020-14295
2026-08-27 KitPloitKITPLOIT
CVE-2020-14295
2026-08-24 KitPloitKITPLOIT
Cacti 1.2.12 SQL Injection / Remote Command Execution Exploit
2021-06-02 metasploitZDTRuby
Cacti 1.2.12 SQL Injection / Remote Command Execution
2021-06-02 h00diePACKETSTORMRuby
Exploit for SQL Injection in Cacti
2021-05-28 mrg3ntl3m4nGITHUB
Cacti 1.2.12 - (filter) SQL Injection / Remote Code Execution Exploit
2021-04-29 zdtZDTPython
Cacti 1.2.12 - 'filter' SQL Injection
2021-04-29 Leonardo PaivaEXPLOITDBPython
Cacti 1.2.12 SQL Injection / Remote Code Execution
2021-04-29 M4yFlyPACKETSTORMPython
Exploit for SQL Injection in Cacti
2021-04-28 0z09eGITHUB
Cacti color filter authenticated SQLi to RCE
2020-06-17 h00die, Leonardo Paiva, Mayfly277METASPLOITRuby