Cacti is vulnerable to a reflected Cross‑Site Scripting flaw that propagates through the "tab" parameter in auth_profile.php. The parameter value is injected directly into the page’s JavaScript context, so if an attacker supplies a malicious value, arbitrary JavaScript will run in the victim’s browser. This code executes with the privileges of the user who is viewing the page and can manipulate page content or access data available to that user.

Cacti, versions 1.2.30 and earlier are affected. The vulnerability was resolved in version 1.2.31 and later.

The CVSS score of 5.3 indicates a moderate severity potential. No EPSS data is published, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not been observed. The likely attack vector requires a victim to click or otherwise navigate to a URL that includes a crafted "tab" parameter; the malicious content is then reflected into the JavaScript context of the page.