Opmantek develops a focused line of network management and IT audit software, with exposure concentrating in its Open-Audit product—a widely deployed tool for infrastructure inventory and compliance scanning that occupies a prominent place in enterprise network-operations environments. Vulnerabilities affecting the vendor skew toward serious outcomes and frequently acquire public exploit code; the recurring weakness classes center on web-application input handling, including cross-site scripting, OS and command injection, path traversal, and SQL injection, reflecting the product's direct exposure to untrusted network data and its integration with backend systems. Defenders should treat this vendor's advisories as operationally significant given the sensitive scope of its products and the availability of public exploit tooling; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Opmantek over time
Signals from CVEs in this vendor scope (18 CVEs).
18 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-8813HIGH graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege. | Feb 22, 2020 | 8.8 | 80 | NO | YES |
CVE-2018-14493MEDIUM Cross-site scripting (XSS) vulnerability in the Groups Page in Open-Audit Community 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the group name. | Jul 25, 2018 | 6.1 | 52 | NO | YES |
CVE-2020-11943HIGH An issue was discovered in Open-AudIT 3.2.2. There is Arbitrary file upload. | Apr 29, 2020 | 8.8 | 33 | NO | NO |
CVE-2021-44916MEDIUM Opmantek Open-AudIT Community 4.2.0 (Fixed in 4.3.0) is affected by a Cross Site Scripting (XSS) vulnerability. If a bad value is passed to the routine via a URL, malicious JavaScr | Dec 20, 2021 | 6.1 | 32 | NO | YES |
CVE-2020-12078HIGH An issue was discovered in Open-AudIT 3.3.1. There is shell metacharacter injection via attributes to an open-audit/configuration/ URI. An attacker can exploit this by adding an ex | Apr 28, 2020 | 8.8 | 32 | NO | NO |
CVE-2021-40612CRITICAL An issue was discovered in Opmantek Open-AudIT after 3.5.0. Without authentication, a vulnerability in code_igniter/application/controllers/util.php allows an attacker perform comm | Dec 22, 2021 | 9.8 | 31 | NO | NO |
CVE-2019-16293HIGH The Create Discoveries feature of Open-AudIT before 3.2.0 allows an authenticated attacker to execute arbitrary OS commands via a crafted value for a URL field. | Sep 13, 2019 | 8.8 | 28 | NO | NO |
CVE-2018-11124MEDIUM Cross-site scripting (XSS) vulnerability in Attributes functionality in Open-AudIT Community edition before 2.2.2 allows remote attackers to inject arbitrary web script or HTML via | Jul 6, 2018 | 5.4 | 28 | NO | YES |
CVE-2018-10314MEDIUM Cross-site scripting (XSS) vulnerability in Open-AudIT Community 2.2.0 allows remote attackers to inject arbitrary web script or HTML via a crafted name of a component, as demonstr | May 10, 2018 | 5.4 | 27 | NO | YES |
CVE-2021-44674MEDIUM An information exposure issue has been discovered in Opmantek Open-AudIT 4.2.0. The vulnerability allows an authenticated attacker to read file outside of the restricted directory. | Jan 3, 2022 | 6.5 | 24 | NO | NO |
Signals from CVEs in this vendor scope (18 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Opmantek.
Media articles that mention a CVE ID that affects a product developed by Opmantek — matched by CVE ID, not by vendor name.