The vulnerability is a pre‑authentication SQL injection in the graph_view.php file of Cacti. An attacker can supply crafted input that bypasses the unanchored FILTER_VALIDATE_REGEXP validation and inject arbitrary SQL statements before any authentication is required. This flaw can allow an attacker to read, modify, or delete data stored in the database, which may lead to database compromise.

Cacti – version 1.2.30 and earlier are affected. The problem is fixed in 1.2.31 and later releases. Only instances running the vulnerable Cacti code are at risk.

The CVSS score of 9.8 indicates a critical level of severity, and the lack of an EPSS score simply means no current estimate of exploit probability is available. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is a network‑accessible HTTP request to graph_view.php with crafted query parameters, requiring no authentication. Successful exploitation would grant the attacker uncontrolled SQL execution on the Cacti database, potentially compromising confidential data.