lib/html.php in Cacti before 1.1.18 has XSS via the title field of an external link added by an authenticated user.
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "cacti": "1.1.18+ds1-1" } ] }