Cacti before 1.1.37 has XSS because the getcurrentpage function in lib/functions.php relies on $SERVER['PHPSELF'] instead of $SERVER['SCRIPTNAME'] to determine a page name.

Cacti before 1.1.37 has XSS because it makes certain htmlspecialchars calls without the ENTQUOTES flag (these calls occur when the htmlescape function in lib/html.php is not used).

Cacti before 1.1.37 has XSS because it does not properly reject unintended characters, related to use of the sanitizeuri function in lib/functions.php.