diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5ad5743d..a47882ef 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,6 +14,7 @@
 * security: Restrict Net_DNS2 cache deserialization to DNS response classes
 * security: Remove all inline JavaScript handlers like onClick, onChange
 * security: Add a version-safe CSP nonce (`plugin_mactrack_csp_nonce()`) to every inline `<script>` tag
+* security: Require POST for the device rescan, site scan, enable and disable actions
 * issue#246: Fix Cisco device collection
 * issue#248: Cacti process control, terminate dns resolvet when is nothing to do
 * issue#250: Disable automatic MIBs load
@@ -27,6 +28,7 @@
 * issue: Pin the CI database image and shared test dependencies, disable persisted checkout credentials, and limit workflow permissions and runtime
 * issue: Reach PHPStan level 8 with zero errors across all first-party PHP and add native function return type declarations, using no baselines or inline suppressions
 * issue: Use prepared statements for all vendor collection
+* issue: Use prepared statements for device-reported values in the interface, ARP, DHCP snooping and 802.1x scanners
 * issue: Fix a variable-variable typo that broke 3Com interface-graph mac updates
 * issue: Return the rendered device-row HTML from the enable/disable AJAX handlers, which previously captured an always-null value
 * issue: Decode MAC/IP OIDs as hex in the Extreme scanner by correcting a misplaced xform_stripped_oid() argument
diff --git a/js/mactrack.js b/js/mactrack.js
index 81d19f28..c22c8fca 100644
--- a/js/mactrack.js
+++ b/js/mactrack.js
@@ -26,24 +26,30 @@ var url
 function scan_device(device_id) {
 	url = urlPath + 'plugins/mactrack/mactrack_ajax_admin.php?action=rescan&device_id=' + device_id
 	$('#r_' + device_id).find('i').addClass('fa-spin');
-	$.getJSON(url, function(data) {
+	$.post(url, { __csrf_magic: csrfMagicToken }, function(data) {
 		type      = data.type;
 		device_id = data.device_id;
 		content   = data.content;
 		$('#r_' + device_id).find('i').removeClass('fa-spin');
 		$('#response').hide().html(content).dialog({ width: 800, maxHeight: 500 });
+	}, 'json').fail(function(data) {
+		$('#r_' + device_id).find('i').removeClass('fa-spin');
+		getPresentHTTPError(data);
 	});
 }
 
 function site_scan(site_id) {
 	url = urlPath + 'plugins/mactrack/mactrack_ajax_admin.php?action=site_scan&site_id=' + site_id;
 	$('#r_' + site_id).find('i').addClass('fa-spin');
-	$.getJSON(url, function(data) {
+	$.post(url, { __csrf_magic: csrfMagicToken }, function(data) {
 		var type      = data.type;
 		var site_id   = data.site_id
 		var content   = data.content;
 		$('#r_' + site_id).find('i').removeClass('fa-spin');
 		$('#response').hide().html(content).dialog({ width: 800, maxHeight: 500 });
+	}, 'json').fail(function(data) {
+		$('#r_' + site_id).find('i').removeClass('fa-spin');
+		getPresentHTTPError(data);
 	});
 }
 
@@ -51,13 +57,16 @@ function scan_device_interface(device_id, ifIndex) {
 	url = urlPath + 'plugins/mactrack/mactrack_ajax_admin.php?action=rescan&device_id=' + device_id + '&ifIndex=' + ifIndex;
 	$('#r_' + device_id + '_' + ifIndex).find('i').addClass('fa-spin');
 
-	$.getJSON(url, function(data) {
+	$.post(url, { __csrf_magic: csrfMagicToken }, function(data) {
 		var type      = data.type;
 		var device_id = data.device_id;
 		var ifIndex   = data.ifIndex;
 		var content   = data.content;
 		$('#r_' + device_id + '_' + ifIndex).find('i').removeClass('fa-spin');
 		$('#response').hide().html(content).dialog({ width: 800, maxHeight: 500 });
+	}, 'json').fail(function(data) {
+		$('#r_' + device_id + '_' + ifIndex).find('i').removeClass('fa-spin');
+		getPresentHTTPError(data);
 	});
 }
 
@@ -67,21 +76,25 @@ function clearScanResults() {
 
 function disable_device(device_id) {
 	url=urlPath + 'plugins/mactrack/mactrack_ajax_admin.php?action=disable&device_id=' + device_id;
-	$.getJSON(url, function(data) {
+	$.post(url, { __csrf_magic: csrfMagicToken }, function(data) {
 		var type      = data.type;
 		var device_id = data.device_id;
 		var content   = data.content;
 		$('#line_' + device_id).html(content);
+	}, 'json').fail(function(data) {
+		getPresentHTTPError(data);
 	});
 }
 
 function enable_device(device_id) {
 	url=urlPath + 'plugins/mactrack/mactrack_ajax_admin.php?action=enable&device_id=' + device_id;
-	$.getJSON(url, function(data) {
+	$.post(url, { __csrf_magic: csrfMagicToken }, function(data) {
 		var type      = data.type;
 		var device_id = data.device_id;
 		var content   = data.content;
 		$('#line_' + device_id).html(content);
+	}, 'json').fail(function(data) {
+		getPresentHTTPError(data);
 	});
 }
 
diff --git a/lib/mactrack_aruba_oscx.php b/lib/mactrack_aruba_oscx.php
index 08b37068..ef0db86f 100644
--- a/lib/mactrack_aruba_oscx.php
+++ b/lib/mactrack_aruba_oscx.php
@@ -517,24 +517,27 @@ function get_aruba_oscx_arp_table($site, &$device): void {
 
 	// output details to database
 	if (cacti_sizeof($result)) {
-		$sql = [];
+		$sql    = [];
+		$params = [];
 
 		foreach ($result as $key=>$value) {
-			$sql[] = '(' .
-				$device['site_id'] . ', ' .
-				$device['device_id'] . ', ' .
-				db_qstr($device['hostname']) . ', ' .
-				db_qstr($device['device_name']) . ', ' .
-				db_qstr($value['port']) . ', ' .
-				db_qstr($value['mac']) . ', ' .
-				db_qstr($key) . ', ' .
-				db_qstr($scan_date) . ')';
+			$sql[] = '(?, ?, ?, ?, ?, ?, ?, ?)';
+
+			array_push($params,
+				$device['site_id'],
+				$device['device_id'],
+				$device['hostname'],
+				$device['device_name'],
+				$value['port'],
+				$value['mac'],
+				$key,
+				$scan_date);
 		}
 
 		if (cacti_sizeof($sql)) {
-			db_execute('REPLACE INTO mac_track_ips 
+			db_execute_prepared('REPLACE INTO mac_track_ips
 				(site_id, device_id, hostname, device_name, port_number, mac_address,ip_address,scan_date)
-				VALUES ' . implode(', ', $sql));
+				VALUES ' . implode(', ', $sql), $params);
 		}
 	}
 
diff --git a/lib/mactrack_cisco.php b/lib/mactrack_cisco.php
index bd0e6f4e..afe662a0 100644
--- a/lib/mactrack_cisco.php
+++ b/lib/mactrack_cisco.php
@@ -764,20 +764,20 @@ function get_cisco_dhcpsnooping_table($site, &$device): void {
 	if (cacti_sizeof($cdsBindingEntries)) {
 		foreach ($cdsBindingEntries as $cdsBindingEntry) {
 			if ($cdsBindingEntry['cdsBindingsIpAddress'] != '') { // It's acceptable to have IPs without a MAC (meaning that MAC is not present but DHCP entry is still present) here but not the other way around.
-				$insert_string = 'REPLACE INTO mac_track_ips
+				db_execute_prepared('REPLACE INTO mac_track_ips
 					(site_id,device_id,hostname,device_name,port_number,
 					mac_address,ip_address,scan_date)
-					VALUES (' .
-					$device['site_id'] . ',' .
-					$device['device_id'] . ',' .
-					db_qstr($device['hostname']) . ',' .
-					db_qstr($device['device_name']) . ',' .
-					db_qstr($cdsBindingEntry['cdsBindingIndex']) . ',' .
-					db_qstr($cdsBindingEntry['dot1dTpFdbEntry']) . ',' .
-					db_qstr($cdsBindingEntry['cdsBindingsIpAddress']) . ',' .
-					db_qstr($scan_date) . ')';
-
-				db_execute($insert_string);
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?)',
+					[
+						$device['site_id'],
+						$device['device_id'],
+						$device['hostname'],
+						$device['device_name'],
+						$cdsBindingEntry['cdsBindingIndex'],
+						$cdsBindingEntry['dot1dTpFdbEntry'],
+						$cdsBindingEntry['cdsBindingsIpAddress'],
+						$scan_date
+					]);
 			}
 		}
 	}
@@ -812,20 +812,21 @@ function get_cisco_vrf_arp_table($site, &$device): void {
 	// output details to database
 	if (cacti_sizeof($cdsBindingEntries)) {
 		foreach ($cdsBindingEntries as $cdsBindingEntry) {
-			$insert_string = 'INSERT INTO mac_track_arp
+			db_execute_prepared('INSERT INTO mac_track_arp
 				(site_id,ip_address,mac_address,scan_date)
 				VALUES
-				(' .
-					$device['site_id'] . ',' .
-					db_qstr($cdsBindingEntry['key']) . ',' .
-					db_qstr($cdsBindingEntry['value']) . ',' .
-					db_qstr($scan_date) . '
-				)
+				(?, ?, ?, ?)
 				ON DUPLICATE KEY UPDATE
-				`ip_address` = ' . db_qstr($cdsBindingEntry['key']) . ',
-				`scan_date` = ' . db_qstr($scan_date) . ';';
-
-			db_execute($insert_string);
+				`ip_address` = ?,
+				`scan_date` = ?',
+				[
+					$device['site_id'],
+					$cdsBindingEntry['key'],
+					$cdsBindingEntry['value'],
+					$scan_date,
+					$cdsBindingEntry['key'],
+					$scan_date
+				]);
 		}
 	}
 
@@ -901,6 +902,7 @@ function get_cisco_dot1x_table($site, &$device): void {
 
 	// output details to database
 	$sql    = [];
+	$params = [];
 	$prefix = 'REPLACE INTO mac_track_dot1x
 		(site_id, device_id, hostname, device_name, username, mac_address, ip_address, domain, status, port_number, scan_date)
 		VALUES ';
@@ -908,22 +910,25 @@ function get_cisco_dot1x_table($site, &$device): void {
 	if (cacti_sizeof($entries)) {
 		foreach ($entries as $entry) {
 			if ($entry['UserName'] != '') {
-				$sql[] = '(' . $device['site_id'] . ',' .
-					$device['device_id'] . ',' .
-					db_qstr($device['hostname']) . ',' .
-					db_qstr($device['device_name']) . ',' .
-					db_qstr($entry['UserName']) . ',' .
-					db_qstr($entry['cafSessionClientMacAddress']) . ',' .
-					db_qstr($entry['cafSessionClientAddress']) . ',' .
-					db_qstr($entry['cafSessionDomain']) . ',' .
-					db_qstr($entry['cafSessionStatus']) . ',' .
-					db_qstr($entry['port_number']) . ',' .
-					db_qstr($scan_date) . ')';
+				$sql[] = '(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)';
+
+				array_push($params,
+					$device['site_id'],
+					$device['device_id'],
+					$device['hostname'],
+					$device['device_name'],
+					$entry['UserName'],
+					$entry['cafSessionClientMacAddress'],
+					$entry['cafSessionClientAddress'],
+					$entry['cafSessionDomain'],
+					$entry['cafSessionStatus'],
+					$entry['port_number'],
+					$scan_date);
 			}
 		}
 
 		if (cacti_sizeof($sql)) {
-			db_execute($prefix . implode(', ', $sql));
+			db_execute_prepared($prefix . implode(', ', $sql), $params);
 		}
 	}
 }
diff --git a/lib/mactrack_enterasys_N7.php b/lib/mactrack_enterasys_N7.php
index 22e69ccf..b1cb1e72 100644
--- a/lib/mactrack_enterasys_N7.php
+++ b/lib/mactrack_enterasys_N7.php
@@ -535,7 +535,8 @@ function get_CTAlias_table($site, &$device): void {
 
 	// output details to database
 	if (cacti_sizeof($CTAliasEntries)) {
-		$sql = [];
+		$sql    = [];
+		$params = [];
 
 		foreach ($CTAliasEntries as $CTAliasEntry) {
 			// drop non-IP protocols
@@ -543,20 +544,22 @@ function get_CTAlias_table($site, &$device): void {
 				continue;
 			}
 
-			$sql[] = '(' .
-				$device['site_id'] . ', ' .
-				$device['device_id'] . ', ' .
-				db_qstr($device['hostname']) . ', ' .
-				db_qstr($device['device_name']) . ', ' .
-				db_qstr($CTAliasEntry['ifIndex']) . ', ' .
-				db_qstr($CTAliasEntry['CTAliasMacAddress']) . ', ' .
-				db_qstr($CTAliasEntry['CTAliasAddressText']) . ', ' .
-				db_qstr($scan_date) . ')';
+			$sql[] = '(?, ?, ?, ?, ?, ?, ?, ?)';
+
+			array_push($params,
+				$device['site_id'],
+				$device['device_id'],
+				$device['hostname'],
+				$device['device_name'],
+				$CTAliasEntry['ifIndex'],
+				$CTAliasEntry['CTAliasMacAddress'],
+				$CTAliasEntry['CTAliasAddressText'],
+				$scan_date);
 		}
 
-		db_execute('REPLACE INTO mac_track_ips
+		db_execute_prepared('REPLACE INTO mac_track_ips
 			(site_id,device_id,hostname,device_name,port_number, mac_address,ip_address,scan_date)
-			VALUES ' . implode(', ', $sql));
+			VALUES ' . implode(', ', $sql), $params);
 	}
 
 	// save ip information for the device
diff --git a/lib/mactrack_extreme.php b/lib/mactrack_extreme.php
index 517fea0b..4a3fafd1 100644
--- a/lib/mactrack_extreme.php
+++ b/lib/mactrack_extreme.php
@@ -348,24 +348,27 @@ function get_extreme_arp_table($site, &$device, $extremeware = false): void {
 
 	// output details to database
 	if (cacti_sizeof($atEntries)) {
-		$sql = [];
+		$sql    = [];
+		$params = [];
 
 		foreach ($atEntries as $atEntry) {
-			$sql[] = '(' .
-				$device['site_id'] . ', ' .
-				$device['device_id'] . ', ' .
-				db_qstr($device['hostname']) . ', ' .
-				db_qstr($device['device_name']) . ', ' .
-				db_qstr($atEntry['atifIndex']) . ', ' .
-				db_qstr($atEntry['atPhysAddress']) . ', ' .
-				db_qstr($atEntry['atNetAddress']) . ', ' .
-				db_qstr($scan_date) . ')';
+			$sql[] = '(?, ?, ?, ?, ?, ?, ?, ?)';
+
+			array_push($params,
+				$device['site_id'],
+				$device['device_id'],
+				$device['hostname'],
+				$device['device_name'],
+				$atEntry['atifIndex'],
+				$atEntry['atPhysAddress'],
+				$atEntry['atNetAddress'],
+				$scan_date);
 		}
 
 		if (cacti_sizeof($sql)) {
-			db_execute('REPLACE INTO mac_track_ips
+			db_execute_prepared('REPLACE INTO mac_track_ips
                 (site_id, device_id, hostname, device_name, port_number, mac_address,ip_address,scan_date)
-                VALUES ' . implode(', ', $sql));
+                VALUES ' . implode(', ', $sql), $params);
 		}
 	}
 
diff --git a/lib/mactrack_functions.php b/lib/mactrack_functions.php
index 5381fce5..7695edd0 100644
--- a/lib/mactrack_functions.php
+++ b/lib/mactrack_functions.php
@@ -766,7 +766,8 @@ function build_InterfacesTable(&$device, &$ifIndexes, $getLinkPorts = false, $ge
 		stateChanges=VALUES(stateChanges),
 		present="1"';
 
-	$insert_vals = '';
+	$insert_vals   = '';
+	$insert_params = [];
 
 	$ifSpeed = xform_standard_indexed_data('.1.3.6.1.2.1.2.2.1.5', $device);
 	mactrack_debug("ifSpeed data collection complete. '" . cacti_sizeof($ifSpeed) . "' rows found!");
@@ -1057,46 +1058,51 @@ function build_InterfacesTable(&$device, &$ifIndexes, $getLinkPorts = false, $ge
 
 		$mac_address = isset($ifPhysAddress[$ifIndex]) ? xform_mac_address($ifPhysAddress[$ifIndex]) : '';
 
-		$insert_vals .= "('" .
-			$device['site_id'] . "', '" . $device['device_id'] . "', '" .
-			$device['snmp_sysUptime'] . "', '" . $ifIndex . "', " .
-			db_qstr($type) . ', ' . db_qstr($name) . ', ' .
-			db_qstr($ifAlias) . ", '" . $linkPort . "', '" .
-			$vlan_id . "', " . db_qstr($vlan_name) . ", '" .
-			$vlan_trunk . "', '" . $speed . "', '" .
-			(isset($ifHighSpeed[$ifIndex]) ? $ifHighSpeed[$ifIndex] : '') . "', '" .
-			(isset($ifDuplex[$ifIndex]) ? $ifDuplex[$ifIndex] : '') . "', " .
-			db_qstr($desc) . ", '" .
-			(isset($ifMtu[$ifIndex]) ? $ifMtu[$ifIndex] : '') . "', " .
-			db_qstr($mac_address) . ", '" .
-			(isset($ifAdminStatus[$ifIndex]) ? $ifAdminStatus[$ifIndex] : '') . "', '" .
-			(isset($ifOperStatus[$ifIndex]) ? $ifOperStatus[$ifIndex] : '') . "', '" .
-			(isset($ifLastChange[$ifIndex]) ? $ifLastChange[$ifIndex] : '') . "', '" .
-			(isset($ifInOctets[$ifIndex]) ? $ifInOctets[$ifIndex] : '') . "', '" .
-			(isset($ifOutOctets[$ifIndex]) ? $ifOutOctets[$ifIndex] : '') . "', '" .
-			(isset($ifHCInOctets[$ifIndex]) ? $ifHCInOctets[$ifIndex] : '') . "', '" .
-			(isset($ifHCOutOctets[$ifIndex]) ? $ifHCOutOctets[$ifIndex] : '') . "', '" .
-			(isset($ifInUcastPkts[$ifIndex]) ? $ifInUcastPkts[$ifIndex] : '') . "', '" .
-			(isset($ifOutUcastPkts[$ifIndex]) ? $ifOutUcastPkts[$ifIndex] : '') . "', '" .
-			(isset($ifInDiscards[$ifIndex]) ? $ifInDiscards[$ifIndex] : '') . "', '" .
-			(isset($ifInErrors[$ifIndex]) ? $ifInErrors[$ifIndex] : '') . "', '" .
-			(isset($ifInUnknownProtos[$ifIndex]) ? $ifInUnknownProtos[$ifIndex] : '') . "', '" .
-			(isset($ifOutDiscards[$ifIndex]) ? $ifOutDiscards[$ifIndex] : '') . "', '" .
-			(isset($ifOutErrors[$ifIndex]) ? $ifOutErrors[$ifIndex] : '') . "', '" .
-			(isset($ifInMulticastPkts[$ifIndex]) ? $ifInMulticastPkts[$ifIndex] : '') . "', '" .
-			(isset($ifOutMulticastPkts[$ifIndex]) ? $ifOutMulticastPkts[$ifIndex] : '') . "', '" .
-			(isset($ifInBroadcastPkts[$ifIndex]) ? $ifInBroadcastPkts[$ifIndex] : '') . "', '" .
-			(isset($ifOutBroadcastPkts[$ifIndex]) ? $ifOutBroadcastPkts[$ifIndex] : '') . "', '" .
-			@$int_ifInOctets . "', '" . @$int_ifOutOctets . "', '" .
-			@$int_ifHCInOctets . "', '" . @$int_ifHCOutOctets . "', '" .
-			@$int_ifInMulticastPkts . "', '" . @$int_ifOutMulticastPkts . "', '" .
-			@$int_ifInBroadcastPkts . "', '" . @$int_ifOutBroadcastPkts . "', '" .
-			@$int_ifInUcastPkts . "', '" . @$int_ifOutUcastPkts . "', '" .
-			@$int_ifInDiscards . "', '" . @$int_ifInErrors . "', '" .
-			@$int_ifInUnknownProtos . "', '" . @$int_ifOutDiscards . "', '" .
-			@$int_ifOutErrors . "', '" . @$int_discards_present . "', '" .
-			$int_errors_present . "', '" . $last_down_time . "', '" .
-			$last_up_time . "', '" . $stateChanges . "', '" . "1')";
+		$insert_row = [
+			$device['site_id'], $device['device_id'],
+			$device['snmp_sysUptime'] ?? '', $ifIndex,
+			$type, $name,
+			$ifAlias, $linkPort,
+			$vlan_id, $vlan_name,
+			$vlan_trunk, $speed,
+			(isset($ifHighSpeed[$ifIndex]) ? $ifHighSpeed[$ifIndex] : ''),
+			(isset($ifDuplex[$ifIndex]) ? $ifDuplex[$ifIndex] : ''),
+			$desc,
+			(isset($ifMtu[$ifIndex]) ? $ifMtu[$ifIndex] : ''),
+			$mac_address,
+			(isset($ifAdminStatus[$ifIndex]) ? $ifAdminStatus[$ifIndex] : ''),
+			(isset($ifOperStatus[$ifIndex]) ? $ifOperStatus[$ifIndex] : ''),
+			(isset($ifLastChange[$ifIndex]) ? $ifLastChange[$ifIndex] : ''),
+			(isset($ifInOctets[$ifIndex]) ? $ifInOctets[$ifIndex] : ''),
+			(isset($ifOutOctets[$ifIndex]) ? $ifOutOctets[$ifIndex] : ''),
+			(isset($ifHCInOctets[$ifIndex]) ? $ifHCInOctets[$ifIndex] : ''),
+			(isset($ifHCOutOctets[$ifIndex]) ? $ifHCOutOctets[$ifIndex] : ''),
+			(isset($ifInUcastPkts[$ifIndex]) ? $ifInUcastPkts[$ifIndex] : ''),
+			(isset($ifOutUcastPkts[$ifIndex]) ? $ifOutUcastPkts[$ifIndex] : ''),
+			(isset($ifInDiscards[$ifIndex]) ? $ifInDiscards[$ifIndex] : ''),
+			(isset($ifInErrors[$ifIndex]) ? $ifInErrors[$ifIndex] : ''),
+			(isset($ifInUnknownProtos[$ifIndex]) ? $ifInUnknownProtos[$ifIndex] : ''),
+			(isset($ifOutDiscards[$ifIndex]) ? $ifOutDiscards[$ifIndex] : ''),
+			(isset($ifOutErrors[$ifIndex]) ? $ifOutErrors[$ifIndex] : ''),
+			(isset($ifInMulticastPkts[$ifIndex]) ? $ifInMulticastPkts[$ifIndex] : ''),
+			(isset($ifOutMulticastPkts[$ifIndex]) ? $ifOutMulticastPkts[$ifIndex] : ''),
+			(isset($ifInBroadcastPkts[$ifIndex]) ? $ifInBroadcastPkts[$ifIndex] : ''),
+			(isset($ifOutBroadcastPkts[$ifIndex]) ? $ifOutBroadcastPkts[$ifIndex] : ''),
+			@$int_ifInOctets, @$int_ifOutOctets,
+			@$int_ifHCInOctets, @$int_ifHCOutOctets,
+			@$int_ifInMulticastPkts, @$int_ifOutMulticastPkts,
+			@$int_ifInBroadcastPkts, @$int_ifOutBroadcastPkts,
+			@$int_ifInUcastPkts, @$int_ifOutUcastPkts,
+			@$int_ifInDiscards, @$int_ifInErrors,
+			@$int_ifInUnknownProtos, @$int_ifOutDiscards,
+			@$int_ifOutErrors, @$int_discards_present,
+			$int_errors_present, $last_down_time,
+			$last_up_time, $stateChanges, '1'
+		];
+
+		$insert_vals .= '(' . implode(', ', array_fill(0, cacti_sizeof($insert_row), '?')) . ')';
+
+		array_push($insert_params, ...$insert_row);
 
 		$i++;
 	}
@@ -1105,7 +1111,7 @@ function build_InterfacesTable(&$device, &$ifIndexes, $getLinkPorts = false, $ge
 
 	if ($insert_vals != '') {
 		// add/update records in the database
-		db_execute($insert_prefix . $insert_vals . $insert_suffix);
+		db_execute_prepared($insert_prefix . $insert_vals . $insert_suffix, $insert_params);
 
 		// remove all obsolete records from the database
 		db_execute_prepared('DELETE FROM mac_track_interfaces
@@ -1217,8 +1223,9 @@ function mactrack_find_host_graphs($device_id, $host_id): void {
 		}
 	}
 
-	$sql   = '';
-	$found = 0;
+	$sql    = '';
+	$params = [];
+	$found  = 0;
 
 	if (cacti_sizeof($output_array)) {
 		$interfaces = array_rekey(
@@ -1232,15 +1239,18 @@ function mactrack_find_host_graphs($device_id, $host_id): void {
 			foreach ($interfaces as $key => $data) {
 				if (isset($output_array[$key])) {
 					foreach ($output_array[$key] as $local_graph_id => $graph_details) {
-						$sql .= ($sql != '' ? ', (' : '(') .
-							$data['ifIndex'] . ",'" .
-							$key . "'," .
-							$local_graph_id . ',' .
-							$device_id . ',' .
-							$host_id . ',' .
-							$graph_details[0] . ',' .
-							$graph_details[1] . ",'" .
-							$key . "','" . $field_name . "', 1)";
+						$sql .= ($sql != '' ? ', ' : '') . '(?, ?, ?, ?, ?, ?, ?, ?, ?, 1)';
+
+						array_push($params,
+							$data['ifIndex'],
+							$key,
+							$local_graph_id,
+							$device_id,
+							$host_id,
+							$graph_details[0],
+							$graph_details[1],
+							$key,
+							$field_name);
 
 						$found++;
 					}
@@ -1257,7 +1267,7 @@ function mactrack_find_host_graphs($device_id, $host_id): void {
 			AND host_id = ?',
 			[$device_id, $host_id]);
 
-		db_execute("INSERT INTO mac_track_interface_graphs
+		db_execute_prepared("INSERT INTO mac_track_interface_graphs
 			(ifIndex, ifName, local_graph_id, device_id, host_id, snmp_query_id, graph_template_id, field_value, field_name, present)
 			VALUES $sql
 			ON DUPLICATE KEY UPDATE
@@ -1265,7 +1275,7 @@ function mactrack_find_host_graphs($device_id, $host_id): void {
 				graph_template_id=VALUES(graph_template_id),
 				field_value=VALUES(field_value),
 				field_name=VALUES(field_name),
-				present=VALUES(present)");
+				present=VALUES(present)", $params);
 
 		db_execute_prepared('DELETE FROM mac_track_interface_graphs
 			WHERE present = 0
@@ -3717,6 +3727,28 @@ function mactrack_display_Octets($octets): string {
 	return $octets . ' ' . $suffix;
 }
 
+/**
+ * Rejects an admin AJAX action that did not arrive as a POST.
+ *
+ * Cacti's csrf-magic checks the token on POST only, so a state change
+ * reachable over GET would skip that check.
+ *
+ * @return bool True for a POST, false after sending a 405 response.
+ */
+function mactrack_require_post(): bool {
+	if (isset($_SERVER['REQUEST_METHOD']) && $_SERVER['REQUEST_METHOD'] === 'POST') {
+		return true;
+	}
+
+	http_response_code(405);
+	header('Allow: POST');
+	header('Content-Type: application/json; charset=utf-8');
+
+	print json_encode(['error' => 'POST required']);
+
+	return false;
+}
+
 /**
  * Triggers an ad hoc rescan of a single device (invoked via AJAX from
  * the interface/device views), logging the action and running the
@@ -3735,6 +3767,10 @@ function mactrack_display_Octets($octets): string {
 function mactrack_rescan($web = false): void {
 	global $config;
 
+	if (!mactrack_require_post()) {
+		return;
+	}
+
 	$device_id = get_filter_request_var('device_id');
 	$ifIndex   = get_filter_request_var('ifIndex');
 
@@ -3797,6 +3833,10 @@ function mactrack_rescan($web = false): void {
 function mactrack_site_scan($web = false): void {
 	global $config;
 
+	if (!mactrack_require_post()) {
+		return;
+	}
+
 	get_filter_request_var('site_id');
 
 	$site_id = get_filter_request_var('site_id');
@@ -3847,6 +3887,10 @@ function mactrack_site_scan($web = false): void {
  * @return void Prints a JSON response and does not return a value.
  */
 function mactrack_enable(): void {
+	if (!mactrack_require_post()) {
+		return;
+	}
+
 	// ================= input validation =================
 	get_filter_request_var('device_id');
 	// ====================================================
@@ -3898,6 +3942,10 @@ function mactrack_enable(): void {
  * @return void Prints a JSON response and does not return a value.
  */
 function mactrack_disable(): void {
+	if (!mactrack_require_post()) {
+		return;
+	}
+
 	// ================= input validation =================
 	get_filter_request_var('device_id');
 	// ====================================================
diff --git a/lib/mactrack_h3c_3com.php b/lib/mactrack_h3c_3com.php
index 3fad6a9d..ad041383 100644
--- a/lib/mactrack_h3c_3com.php
+++ b/lib/mactrack_h3c_3com.php
@@ -495,24 +495,27 @@ function get_h3c_3com_arp_table($site, &$device): void {
 
 	// output details to database
 	if (cacti_sizeof($atEntries)) {
-		$sql = [];
+		$sql    = [];
+		$params = [];
 
 		foreach ($atEntries as $atEntry) {
-			$sql[] = '(' .
-				$device['site_id'] . ', ' .
-				$device['device_id'] . ', ' .
-				db_qstr($device['hostname']) . ', ' .
-				db_qstr($device['device_name']) . ', ' .
-				db_qstr($atEntry['atifIndex']) . ', ' .
-				db_qstr($atEntry['atPhysAddress']) . ', ' .
-				db_qstr($atEntry['atNetAddress']) . ', ' .
-				db_qstr($scan_date) . ')';
+			$sql[] = '(?, ?, ?, ?, ?, ?, ?, ?)';
+
+			array_push($params,
+				$device['site_id'],
+				$device['device_id'],
+				$device['hostname'],
+				$device['device_name'],
+				$atEntry['atifIndex'],
+				$atEntry['atPhysAddress'],
+				$atEntry['atNetAddress'],
+				$scan_date);
 		}
 
 		if (cacti_sizeof($sql)) {
-			db_execute('REPLACE INTO mac_track_ips 
+			db_execute_prepared('REPLACE INTO mac_track_ips
 				(site_id, device_id, hostname, device_name, port_number, mac_address,ip_address,scan_date)
-				VALUES ' . implode(', ', $sql));
+				VALUES ' . implode(', ', $sql), $params);
 		}
 	}
 
diff --git a/phpunit.xml b/phpunit.xml
index ac7e0e96..e9479d95 100644
--- a/phpunit.xml
+++ b/phpunit.xml
@@ -31,6 +31,11 @@
             <file>includes/database.php</file>
             <file>lib/mactrack_functions.php</file>
             <file>lib/mactrack_dns_resolution.php</file>
+            <file>lib/mactrack_aruba_oscx.php</file>
+            <file>lib/mactrack_cisco.php</file>
+            <file>lib/mactrack_enterasys_N7.php</file>
+            <file>lib/mactrack_extreme.php</file>
+            <file>lib/mactrack_h3c_3com.php</file>
         </include>
     </source>
 </phpunit>
diff --git a/tests/Unit/AdminActionsRequirePostTest.php b/tests/Unit/AdminActionsRequirePostTest.php
new file mode 100644
index 00000000..e3f3b7c4
--- /dev/null
+++ b/tests/Unit/AdminActionsRequirePostTest.php
@@ -0,0 +1,136 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ |                                                                         |
+ | This program is free software; you can redistribute it and/or           |
+ | modify it under the terms of the GNU General Public License             |
+ | as published by the Free Software Foundation; either version 2          |
+ | of the License, or (at your option) any later version.                  |
+ +-------------------------------------------------------------------------+
+ | Cacti: The Complete RRDtool-based Graphing Solution                     |
+ +-------------------------------------------------------------------------+
+ | http://www.cacti.net/                                                   |
+ +-------------------------------------------------------------------------+
+*/
+
+/*
+ * mactrack_ajax_admin.php dispatches to these four functions. Cacti checks
+ * the CSRF token on POST only, so each one must refuse any other method
+ * before it reads or changes anything.
+ */
+
+require_once dirname(__DIR__, 2) . '/lib/mactrack_functions.php';
+
+beforeEach(function () {
+	$GLOBALS['__test_db_calls']     = [];
+	$GLOBALS['__test_next_returns'] = [];
+	$_SESSION['sess_user_id']       = 1;
+});
+
+afterEach(function () {
+	unset($_SERVER['REQUEST_METHOD']);
+	http_response_code(200);
+});
+
+/**
+ * Run an admin action and return what it printed.
+ *
+ * @param string $action Function name.
+ *
+ * @return string
+ */
+function mactrack_test_run_admin_action($action) {
+	ob_start();
+
+	if ($action === 'mactrack_rescan' || $action === 'mactrack_site_scan') {
+		$action(true);
+	} else {
+		$action();
+	}
+
+	return (string) ob_get_clean();
+}
+
+dataset('admin actions', ['mactrack_site_scan', 'mactrack_rescan', 'mactrack_enable', 'mactrack_disable']);
+
+test('a GET to an admin action is refused before it touches the database', function ($action) {
+	$_SERVER['REQUEST_METHOD'] = 'GET';
+
+	$output = mactrack_test_run_admin_action($action);
+
+	expect(json_decode($output, true))->toBe(['error' => 'POST required']);
+	expect(http_response_code())->toBe(405);
+	expect($GLOBALS['__test_db_calls'])->toBe([]);
+})->with('admin actions');
+
+test('a request with no method is refused like a GET', function () {
+	$output = mactrack_test_run_admin_action('mactrack_disable');
+
+	expect(json_decode($output, true))->toBe(['error' => 'POST required']);
+	expect($GLOBALS['__test_db_calls'])->toBe([]);
+});
+
+test('a POST enables and disables the device', function ($action, $disabled) {
+	$_SERVER['REQUEST_METHOD'] = 'POST';
+
+	$device = [
+		'device_id'        => '',
+		'disabled'         => $disabled,
+		'device_name'      => 'sw1',
+		'site_name'        => 'HQ',
+		'snmp_status'      => 3,
+		'hostname'         => 'sw1.example.com',
+		'device_type'      => 'Switch',
+		'scan_type'        => '2',
+		'ips_total'        => 1,
+		'ports_total'      => 48,
+		'ports_active'     => 12,
+		'ports_trunk'      => 2,
+		'macs_active'      => 30,
+		'last_runduration' => 4.2,
+	];
+
+	mactrack_test_queue_return('db_fetch_row_prepared', ['hostname' => 'sw1.example.com']);
+	mactrack_test_queue_return('db_fetch_row_prepared', ['username' => 'admin', 'full_name' => 'Administrator']);
+	mactrack_test_queue_return('db_fetch_row_prepared', $device);
+
+	$output = mactrack_test_run_admin_action($action);
+
+	$updates = array_values(array_filter($GLOBALS['__test_db_calls'], function ($call) {
+		return $call['fn'] === 'db_execute_prepared' && strpos($call['sql'], 'UPDATE mac_track_devices') === 0;
+	}));
+
+	expect($updates)->toHaveCount(1);
+	expect($updates[0]['sql'])->toContain('SET disabled' . ($disabled === 'on' ? '="on"' : ' = ""'));
+	expect(json_decode($output, true))->toHaveKey('content');
+	expect(http_response_code())->not->toBe(405);
+})->with([
+	['mactrack_enable', ''],
+	['mactrack_disable', 'on'],
+]);
+
+test('a POST rescan and site scan look up their target', function ($action, $table) {
+	$_SERVER['REQUEST_METHOD'] = 'POST';
+
+	$output = mactrack_test_run_admin_action($action);
+
+	expect($GLOBALS['__test_db_calls'])->toHaveCount(1);
+	expect($GLOBALS['__test_db_calls'][0]['fn'])->toBe('db_fetch_row_prepared');
+	expect($GLOBALS['__test_db_calls'][0]['sql'])->toContain('FROM ' . $table);
+	expect(json_decode($output, true))->toBe([]);
+})->with([
+	['mactrack_rescan', 'mac_track_devices'],
+	['mactrack_site_scan', 'mac_track_sites'],
+]);
+
+test('the admin actions are sent as POST with the CSRF token and report failures', function () {
+	$js = plugin_test_read_source('js/mactrack.js');
+
+	expect(substr_count($js, 'mactrack_ajax_admin.php'))->toBe(5);
+	expect($js)->not->toContain('getJSON');
+	expect(substr_count($js, '$.post(url, { __csrf_magic: csrfMagicToken }'))->toBe(5);
+	expect(substr_count($js, "}, 'json').fail(function(data) {"))->toBe(5);
+	expect(substr_count($js, 'getPresentHTTPError(data);'))->toBe(5);
+	expect(substr_count($js, "removeClass('fa-spin')"))->toBe(6);
+});
diff --git a/tests/Unit/DeviceReportedValuesBindingTest.php b/tests/Unit/DeviceReportedValuesBindingTest.php
new file mode 100644
index 00000000..73fc6ae5
--- /dev/null
+++ b/tests/Unit/DeviceReportedValuesBindingTest.php
@@ -0,0 +1,292 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ |                                                                         |
+ | This program is free software; you can redistribute it and/or           |
+ | modify it under the terms of the GNU General Public License             |
+ | as published by the Free Software Foundation; either version 2          |
+ | of the License, or (at your option) any later version.                  |
+ +-------------------------------------------------------------------------+
+ | Cacti: The Complete RRDtool-based Graphing Solution                     |
+ +-------------------------------------------------------------------------+
+ | http://www.cacti.net/                                                   |
+ +-------------------------------------------------------------------------+
+*/
+
+/*
+ * The scanners store strings the device reports (interface names, aliases,
+ * descriptions, VLAN names, MACs, IPs, 802.1x user names). Each test runs a
+ * scanner against canned SNMP walks and checks that those strings reach the
+ * database as bound parameters, not as part of the statement text.
+ */
+
+require_once dirname(__DIR__, 2) . '/lib/mactrack_functions.php';
+
+foreach (['cisco', 'aruba_oscx', 'enterasys_N7', 'h3c_3com', 'extreme'] as $vendor) {
+	mactrack_test_load(dirname(__DIR__, 2) . '/lib/mactrack_' . $vendor . '.php');
+}
+
+beforeEach(function () {
+	$GLOBALS['__test_db_calls']        = [];
+	$GLOBALS['__test_next_returns']    = [];
+	$GLOBALS['__test_matched_returns'] = [];
+	$GLOBALS['__test_snmp_walk']       = [];
+	$GLOBALS['scan_date']              = '2026-10-22 10:00:00';
+	$GLOBALS['debug']                  = false;
+
+	$this->device = [
+		'site_id'              => 4,
+		'device_id'            => 9,
+		'host_id'              => 0,
+		'hostname'             => 'sw-lab-01',
+		'device_name'          => 'Lab switch',
+		'snmp_readstring'      => 'public',
+		'snmp_version'         => '2',
+		'snmp_username'        => '',
+		'snmp_password'        => '',
+		'snmp_auth_protocol'   => '',
+		'snmp_priv_passphrase' => '',
+		'snmp_priv_protocol'   => '',
+		'snmp_context'         => '',
+		'snmp_port'            => 161,
+		'snmp_timeout'         => 500,
+		'snmp_retries'         => 1,
+		'max_oids'             => 10,
+		'snmp_engine_id'       => '',
+		'snmp_sysUptime'       => '123456',
+		'snmp_sysDescr'        => 'test agent',
+		'last_rundate'         => '',
+	];
+});
+
+/**
+ * Canned walk rows for one OID, keyed by the index that follows it.
+ *
+ * @param string $oid  Base OID as the scanner passes it.
+ * @param array  $rows index => value
+ *
+ * @return void
+ */
+function mactrack_test_walk($oid, $rows) {
+	foreach ($rows as $index => $value) {
+		$GLOBALS['__test_snmp_walk'][$oid][] = ['oid' => $oid . '.' . $index, 'value' => $value];
+	}
+}
+
+/**
+ * The single recorded call whose SQL starts with $prefix.
+ *
+ * @param string $prefix Leading SQL keywords, e.g. 'REPLACE INTO mac_track_ips'.
+ *
+ * @return array
+ */
+function mactrack_test_find_call($prefix) {
+	$found = [];
+
+	foreach ($GLOBALS['__test_db_calls'] as $call) {
+		if (strpos(ltrim($call['sql']), $prefix) === 0) {
+			$found[] = $call;
+		}
+	}
+
+	expect($found)->toHaveCount(1);
+
+	return $found[0];
+}
+
+/**
+ * Assert the call is prepared, binds every value, and carries none of them in its text.
+ *
+ * @param array $call   Recorded stub call.
+ * @param array $values Device-reported values that must be bound.
+ *
+ * @return void
+ */
+function mactrack_test_expect_bound($call, $values) {
+	expect($call['fn'])->toBe('db_execute_prepared');
+	expect(substr_count($call['sql'], '?'))->toBe(count($call['params']));
+
+	foreach ($values as $value) {
+		expect($call['params'])->toContain($value);
+		expect($call['sql'])->not->toContain($value);
+	}
+}
+
+test('interface rows bind the names, aliases, descriptions and MAC the device reports', function () {
+	mactrack_test_walk('.1.3.6.1.2.1.2.2.1.1', ['5' => '5']);
+	mactrack_test_walk('.1.3.6.1.2.1.2.2.1.3', ['5' => '6']);
+	mactrack_test_walk('.1.3.6.1.2.1.31.1.1.1.1', ['5' => 'Gi1/0/5-lab']);
+	mactrack_test_walk('.1.3.6.1.2.1.31.1.1.1.18', ['5' => 'printer room uplink']);
+	mactrack_test_walk('.1.3.6.1.2.1.2.2.1.2', ['5' => 'GigabitEthernet1/0/5 descr']);
+	mactrack_test_walk('.1.3.6.1.2.1.2.2.1.6', ['5' => '00:11:22:33:44:55']);
+	mactrack_test_walk('.1.3.6.1.2.1.2.2.1.7', ['5' => 'up(1)']);
+	mactrack_test_walk('.1.3.6.1.2.1.2.2.1.8', ['5' => 'down(2)']);
+
+	$ifIndexes = [];
+
+	build_InterfacesTable($this->device, $ifIndexes, false, true);
+
+	$call = mactrack_test_find_call('INSERT INTO mac_track_interfaces');
+
+	mactrack_test_expect_bound($call, ['Gi1/0/5-lab', 'printer room uplink', 'GigabitEthernet1/0/5 descr', '001122334455']);
+
+	expect($call['params'])->toHaveCount(56);
+	expect(array_slice($call['params'], 0, 7))->toBe([4, 9, '123456', '5', '6', 'Gi1/0/5-lab', 'printer room uplink']);
+	expect($call['params'][14])->toBe('GigabitEthernet1/0/5 descr');
+	expect($call['params'][16])->toBe('001122334455');
+	expect($call['params'][17])->toBe(1);
+	expect($call['params'][18])->toBe(0);
+	expect($call['params'][55])->toBe('1');
+});
+
+test('a device with no stored uptime binds an empty sysUptime, not NULL', function () {
+	mactrack_test_walk('.1.3.6.1.2.1.2.2.1.1', ['5' => '5']);
+
+	$this->device['snmp_sysUptime'] = null;
+	$ifIndexes                      = [];
+
+	build_InterfacesTable($this->device, $ifIndexes, false, false);
+
+	$call = mactrack_test_find_call('INSERT INTO mac_track_interfaces');
+
+	expect($call['params'][2])->toBe('');
+	expect($call['params'])->not->toContain(null);
+});
+
+test('interface graph links bind the interface name read back from the device', function () {
+	mactrack_test_queue_return('db_fetch_assoc_prepared', [
+		['id' => 31, 'field_value' => 'Gi1/0/5-lab', 'snmp_query_id' => 2],
+	]);
+	mactrack_test_queue_return('db_fetch_assoc_prepared', [
+		['id' => 41, 'graph_template_id' => 7],
+	]);
+	mactrack_test_queue_return('db_fetch_assoc', [
+		['device_id' => 9, 'ifIndex' => 5, 'ifName' => 'Gi1/0/5-lab'],
+	]);
+
+	mactrack_find_host_graphs(9, 12);
+
+	$call = mactrack_test_find_call('INSERT INTO mac_track_interface_graphs');
+
+	mactrack_test_expect_bound($call, ['Gi1/0/5-lab']);
+
+	expect($call['params'])->toBe([5, 'Gi1/0/5-lab', 41, 9, 12, 7, 2, 'Gi1/0/5-lab', 'ifName']);
+});
+
+test('Cisco DHCP snooping rows bind the port, MAC and IP the device reports', function () {
+	mactrack_test_walk('.1.3.6.1.4.1.9.9.380.1.4.1.1.5', ['10.0.17.34.51.68.85' => 'Gi2/0/7']);
+	mactrack_test_walk('.1.3.6.1.4.1.9.9.380.1.4.1.1.4', ['10.0.17.34.51.68.85' => '192.0.2.10']);
+	mactrack_test_walk('.1.3.6.1.4.1.9.9.46.1.3.1.1.2', ['10' => '1']);
+	mactrack_test_walk('.1.3.6.1.4.1.9.9.46.1.3.1.1.4', ['10' => 'users']);
+	mactrack_test_walk('.1.3.6.1.2.1.17.4.3.1.1', ['0.17.34.51.68.85' => '00 11 22 33 44 55']);
+	mactrack_test_queue_return('cacti_snmp_get', '3');
+
+	// xform_stripped_oid() strips the OID without its leading dot.
+	foreach ($GLOBALS['__test_snmp_walk'] as $oid => $rows) {
+		foreach ($rows as $i => $row) {
+			$GLOBALS['__test_snmp_walk'][$oid][$i]['oid'] = ltrim($row['oid'], '.');
+		}
+	}
+
+	get_cisco_dhcpsnooping_table([], $this->device);
+
+	$call = mactrack_test_find_call('REPLACE INTO mac_track_ips');
+
+	mactrack_test_expect_bound($call, ['Gi2/0/7', '001122334455', '192.0.2.10', 'sw-lab-01', 'Lab switch']);
+
+	expect($call['params'])->toBe([4, 9, 'sw-lab-01', 'Lab switch', 'Gi2/0/7', '001122334455', '192.0.2.10', '2026-10-22 10:00:00']);
+});
+
+test('Cisco VRF ARP rows bind the IP and MAC the device reports', function () {
+	mactrack_test_walk('.1.3.6.1.2.1.3.1.1.2', ['12.1.192.0.2.20' => '0 11 22 33 44 66']);
+
+	get_cisco_vrf_arp_table([], $this->device);
+
+	$call = mactrack_test_find_call('INSERT INTO mac_track_arp');
+
+	mactrack_test_expect_bound($call, ['192.0.2.20', '0:11:22:33:44:66']);
+
+	expect($call['params'])->toBe([4, '192.0.2.20', '0:11:22:33:44:66', '2026-10-22 10:00:00', '192.0.2.20', '2026-10-22 10:00:00']);
+});
+
+test('Cisco 802.1x rows bind the user name, domain and addresses the device reports', function () {
+	$base = '1.3.6.1.4.1.9.9.656.1.4.1.1';
+
+	foreach (['10' => 'lab-user-17', '2' => '00:11:22:33:44:77', '4' => '192.0.2.30', '6' => 'data', '5' => 'authorized'] as $column => $value) {
+		$GLOBALS['__test_snmp_walk']['.' . $base . '.' . $column][] = ['oid' => $base . '.' . $column . '.10101.4', 'value' => $value];
+	}
+
+	get_cisco_dot1x_table([], $this->device);
+
+	$call = mactrack_test_find_call('REPLACE INTO mac_track_dot1x');
+
+	mactrack_test_expect_bound($call, ['lab-user-17', '001122334477', '192.0.2.30', 'authorized']);
+
+	expect($call['params'])->toBe([4, 9, 'sw-lab-01', 'Lab switch', 'lab-user-17', '001122334477', '192.0.2.30', 'data', 'authorized', '10101', '2026-10-22 10:00:00']);
+});
+
+test('Aruba AOS-CX ARP rows bind the port, MAC and IP the device reports', function () {
+	mactrack_test_walk('.1.3.6.1.2.1.17.7.1.2.2.1.2', ['1.0.17.34.51.68.85' => '28']);
+	mactrack_test_walk('.1.3.6.1.2.1.4.35.1.4', ['16777415.1.4.192.0.2.40' => '00 11 22 33 44 55']);
+
+	get_aruba_oscx_arp_table([], $this->device);
+
+	$call = mactrack_test_find_call('REPLACE INTO mac_track_ips');
+
+	mactrack_test_expect_bound($call, ['00:11:22:33:44:55', '192.0.2.40']);
+
+	expect($call['params'])->toBe([4, 9, 'sw-lab-01', 'Lab switch', '28', '00:11:22:33:44:55', '192.0.2.40', '2026-10-22 10:00:00']);
+});
+
+test('Enterasys N7 alias rows bind the MAC and IP text the device reports', function () {
+	mactrack_test_walk('.1.3.6.1.4.1.52.4.1.3.7.1.1.1.1.3', ['100.1' => '7']);
+	mactrack_test_walk('.1.3.6.1.4.1.52.4.1.3.7.1.1.1.1.4', ['100.1' => '00:11:22:33:44:88']);
+	mactrack_test_walk('.1.3.6.1.4.1.52.4.1.3.7.1.1.1.1.6', ['100.1' => '1']);
+	mactrack_test_walk('.1.3.6.1.4.1.52.4.1.3.7.1.1.1.1.9', ['100.1' => '192.0.2.50']);
+
+	get_CTAlias_table([], $this->device);
+
+	$call = mactrack_test_find_call('REPLACE INTO mac_track_ips');
+
+	mactrack_test_expect_bound($call, ['001122334488', '192.0.2.50']);
+
+	expect($call['params'])->toBe([4, 9, 'sw-lab-01', 'Lab switch', '7', '001122334488', '192.0.2.50', '2026-10-22 10:00:00']);
+});
+
+test('H3C/3Com ARP rows bind the interface, MAC and IP the device reports', function () {
+	mactrack_test_walk('.1.3.6.1.2.1.3.1.1.1', ['9.1.192.0.2.60' => 'Vlan-interface60']);
+	mactrack_test_walk('.1.3.6.1.2.1.4.22.1.2', ['9.192.0.2.60' => '00:11:22:33:44:99']);
+	mactrack_test_walk('.1.3.6.1.2.1.3.1.1.3', ['9.1.192.0.2.60' => '192.0.2.60']);
+
+	get_h3c_3com_arp_table([], $this->device);
+
+	$call = mactrack_test_find_call('REPLACE INTO mac_track_ips');
+
+	mactrack_test_expect_bound($call, ['Vlan-interface60', '001122334499', '192.0.2.60']);
+
+	expect($call['params'])->toBe([4, 9, 'sw-lab-01', 'Lab switch', 'Vlan-interface60', '001122334499', '192.0.2.60', '2026-10-22 10:00:00']);
+});
+
+test('Extreme ARP rows bind the interface description, MAC and IP the device reports', function () {
+	$walks = [
+		'.1.3.6.1.2.1.3.1.1.1' => ['9.1.192.0.2.70' => '9'],
+		'.1.3.6.1.2.1.3.1.1.2' => ['9.1.192.0.2.70' => '00:11:22:33:44:aa'],
+		'.1.3.6.1.2.1.3.1.1.3' => ['9.1.192.0.2.70' => 'C0 00 02 46'],
+		'.1.3.6.1.2.1.2.2.1.2' => ['9' => 'vlan70 lab uplink'],
+	];
+
+	foreach ($walks as $oid => $rows) {
+		foreach ($rows as $index => $value) {
+			$GLOBALS['__test_snmp_walk'][$oid][] = ['oid' => ltrim($oid, '.') . '.' . $index, 'value' => $value];
+		}
+	}
+
+	get_extreme_arp_table([], $this->device, true);
+
+	$call = mactrack_test_find_call('REPLACE INTO mac_track_ips');
+
+	mactrack_test_expect_bound($call, ['vlan70 lab uplink', '0011223344AA', '192.0.2.70']);
+
+	expect($call['params'])->toBe([4, 9, 'sw-lab-01', 'Lab switch', 'vlan70 lab uplink', '0011223344AA', '192.0.2.70', '2026-10-22 10:00:00']);
+});
diff --git a/tests/bootstrap-unit.php b/tests/bootstrap-unit.php
index 11496ee2..84005d72 100644
--- a/tests/bootstrap-unit.php
+++ b/tests/bootstrap-unit.php
@@ -455,6 +455,86 @@ function sql_save($array, $table, $key = 'id') {
 	}
 }
 
+/*
+ * Row-rendering helpers mactrack_format_device_row() calls, so the device
+ * enable/disable actions can run to completion.
+ */
+if (!function_exists('filter_value')) {
+	function filter_value($value, $filter, $href = '') {
+		return $value;
+	}
+}
+
+if (!function_exists('get_colored_device_status')) {
+	function get_colored_device_status($disabled, $status, $thold_failure_count = -1, $status_event_count = -1) {
+		return '';
+	}
+}
+
+if (!function_exists('number_format_i18n')) {
+	function number_format_i18n($number, $decimals = null, $baseu = 1024) {
+		return (string) $number;
+	}
+}
+
+if (!function_exists('form_checkbox_cell')) {
+	function form_checkbox_cell($title, $id, $disabled = false) {
+		print '<td></td>';
+	}
+}
+
+if (!function_exists('form_end_row')) {
+	function form_end_row() {
+		print '</tr>';
+	}
+}
+
+/*
+ * SNMP answers for the scanner functions. A test stores the rows a walk of
+ * an OID returns in $GLOBALS['__test_snmp_walk'][$oid], in the
+ * array('oid' => ..., 'value' => ...) shape cacti_snmp_walk() returns.
+ */
+if (!function_exists('cacti_snmp_walk')) {
+	function cacti_snmp_walk($hostname, $community, $oid, $version, $auth_user = '', $auth_pass = '',
+		$auth_proto = '', $priv_pass = '', $priv_proto = '', $context = '',
+		$port = 161, $timeout_ms = 500, $retries = 0, $max_oids = 10, $environ = 0,
+		$engineid = '', $value_output_format = 1) {
+		return $GLOBALS['__test_snmp_walk'][$oid] ?? array();
+	}
+}
+
+if (!function_exists('cacti_snmp_get')) {
+	function cacti_snmp_get($hostname, $community, $oid, $version, $auth_user = '', $auth_pass = '',
+		$auth_proto = '', $priv_pass = '', $priv_proto = '', $context = '',
+		$port = 161, $timeout_ms = 500, $retries = 0, $environ = 0,
+		$engineid = '', $value_output_format = 1) {
+		return mactrack_test_next_return('cacti_snmp_get', '');
+	}
+}
+
+// Same body as Cacti's lib/functions.php.
+if (!function_exists('array_rekey')) {
+	function array_rekey($array, $key, $key_value) {
+		$ret_array = array();
+
+		if (is_array($array)) {
+			foreach ($array as $item) {
+				$item_key = $item[$key];
+
+				if (is_array($key_value)) {
+					foreach ($key_value as $value) {
+						$ret_array[$item_key][$value] = $item[$value];
+					}
+				} else {
+					$ret_array[$item_key] = $item[$key_value];
+				}
+			}
+		}
+
+		return $ret_array;
+	}
+}
+
 if (!defined('CACTI_PATH_BASE')) {
 	define('CACTI_PATH_BASE', $GLOBALS['config']['base_path']);
 }
@@ -475,6 +555,26 @@ function sql_save($array, $table, $key = 'id') {
 	define('POLLER_VERBOSITY_NONE', 6);
 }
 
+if (!defined('POLLER_VERBOSITY_HIGH')) {
+	define('POLLER_VERBOSITY_HIGH', 4);
+}
+
+if (!defined('HOST_UP')) {
+	define('HOST_UP', 3);
+}
+
+if (!defined('SNMP_POLLER')) {
+	define('SNMP_POLLER', 0);
+}
+
+if (!defined('SNMP_STRING_OUTPUT_GUESS')) {
+	define('SNMP_STRING_OUTPUT_GUESS', 1);
+}
+
+if (!defined('SNMP_STRING_OUTPUT_HEX')) {
+	define('SNMP_STRING_OUTPUT_HEX', 3);
+}
+
 if (!defined('MESSAGE_LEVEL_ERROR')) {
 	define('MESSAGE_LEVEL_ERROR', 1);
 }