spikekill.php in Cacti before 1.1.16 might allow remote attackers to execute arbitrary code via the avgnan, outlier-start, or outlier-end parameter.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-12065.json"