Cacti, an open‑source performance and fault management system, has a stored SQL injection flaw in its Reports feature through the graph_name_regexp parameter. An attacker who can supply a crafted value for this parameter can inject arbitrary SQL statements into the underlying query, enabling the attacker to read, modify, or delete data stored in the database. If the database accounts used by the application have elevated privileges, the injection could be leveraged to compromise the entire system.

The vulnerability affects all installations of Cacti version 1.2.30 and earlier. The defect was fixed in Cacti 1.2.31 and subsequent releases. All deployments using the Reports feature are at risk.

The CVSS score of 7.6 categorises the defect as high severity. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to have access to the Cacti web interface for the Reports page, where they can submit the graph_name_regexp value. If the application runs with high‑privilege database credentials, the injected code could provide the attacker with read or write access to sensitive data or enable further exploitation.