A cross-site scripting vulnerability exists in Cacti in the method parameter in spikekill.php. The lib/html.php script in Cacti has a XSS vulnerability via the title field of an external link added by an authenticated user