Cacti 1.2.8 has stored XSS in data_sources.php color_templates_item.php graphs.php graph_items.php lib/api_automation.php user_admin.php and user_group_admin.php as demonstrated by the description parameter in data_sources.php (a raw string from the database that is displayed by $header to trigger the XSS).