CVE-2021-26247: 
Cacti vulnerability analysis and mitigation

A Cross-Site Scripting (XSS) vulnerability was discovered in Cacti affecting version 0.8.7g and earlier. The vulnerability allows an unauthenticated remote user to execute JavaScript code by visiting 'http://<CACTISERVER>/authchangepassword.php?ref=', where the JavaScript payload in the 'ref' URL parameter is successfully executed (NVD).

The vulnerability is classified as a Cross-Site Scripting (XSS) issue (CWE-79) with a CVSS v3.1 Base Score of 6.1 MEDIUM (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The vulnerability exists in the auth_changepassword.php file where user input from the 'ref' parameter is not properly sanitized before being reflected back to the user (NVD).

The vulnerability allows attackers to execute arbitrary JavaScript code in the context of the victim's browser session. This could potentially lead to theft of sensitive information, session hijacking, or other client-side attacks (NVD).

The vulnerability has been fixed in later versions of Cacti. Users should upgrade to a version newer than 0.8.7g. The fix was implemented through commits that properly sanitize the 'ref' parameter input (Debian Tracker).