{"id":"CVE-2025-4648","aliases":["EUVD-2025-14378","GHSA-h46g-35r6-chx9"],"status":"published","title":"A user with elevated privileges can inject XSS by altering the content of a SVG media during the submit request.","description":"The content of a SVG file, received as input \n\nin Centreon web, was not properly checked. Allows Reflected XSS.\nA user with elevated privileges can inject JS script by altering the content of a SVG media, during the submit request.\nThis issue affects web: from 24.10.0 before 24.10.5, from 24.04.0 before 24.04.11, from 23.10.0 before 23.10.22, from 23.04.0 before 23.04.27, from 22.10.0 before 22.10.29.","severity":{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00267,"percentile":0.1897,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-434","CWE-494"],"published":"2025-05-13T09:45:41Z","modified":"2026-10-28T02:30:56Z","products":[{"vendor":"centreon","product":"centreon_web"},{"vendor":"centreon","product":"web"},{"vendor":"com.ritense.valtimo","product":"web"}],"references":[{"url":"https://thewatch.centreon.com/latest-security-bulletins-64/cve-2024-55575-centreon-web-high-severity-4434","tags":["vendor-advisory","Vendor Advisory","advisory"]},{"url":"https://github.com/centreon/centreon/releases","tags":["Release Notes","package"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4648","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-h46g-35r6-chx9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/4xxx/CVE-2025-4648.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-4648","title":"A user with elevated privileges can inject XSS by altering the content of a SVG media during the submit request.","description":"The content of a SVG file, received as input \n\nin Centreon web, was not properly checked. Allows Reflected XSS.\nA user with elevated privileges can inject JS script by altering the content of a SVG media, during the submit request.\nThis issue affects web: from 24.10.0 before 24.10.5, from 24.04.0 before 24.04.11, from 23.10.0 before 23.10.22, from 23.04.0 before 23.04.27, from 22.10.0 before 22.10.29.","status":"published","published":"2025-05-13T09:45:41.519Z","modified":"2025-10-08T10:07:58.081Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:32:48.512547Z"}],"euvd":[{"id":"EUVD-2025-14378","description":"The content of a SVG file, received as input \n\nin Centreon web, was not properly checked. Allows Reflected XSS.\nA user with elevated privileges can inject JS script by altering the content of a SVG media, during the submit request.\nThis issue affects web: from 24.10.0 before 24.10.5, from 24.04.0 before 24.04.11, from 23.10.0 before 23.10.22, from 23.04.0 before 23.04.27, from 22.10.0 before 22.10.29.","status":"published","published":"2025-05-13T09:45:41Z","modified":"2025-10-08T10:07:58Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:31:35.432127Z"}],"ghsa":[{"id":"GHSA-h46g-35r6-chx9","title":"Download of Code Without Integrity Check vulnerability in Centreon web allows Reflected XSS.\nA...","description":"Download of Code Without Integrity Check vulnerability in Centreon web allows Reflected XSS.\nA user with elevated privileges can inject XSS by altering the content of a SVG media during the submit request.\nThis issue affects web: from 24.10.0 before 24.10.5, from 24.04.0 before 24.04.11, from 23.10.0 before 23.10.22, from 23.04.0 before 23.04.27, from 22.10.0 before 22.10.29.","status":"published","published":"2025-05-13T12:31:37Z","modified":"2025-10-08T12:31:32Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-434","CWE-494"],"updated_at":"2026-11-02T15:03:53.457984Z"}],"nvd":[{"id":"CVE-2025-4648","description":"The content of a SVG file, received as input \n\nin Centreon web, was not properly checked. Allows Reflected XSS.\nA user with elevated privileges can inject JS script by altering the content of a SVG media, during the submit request.\nThis issue affects web: from 24.10.0 before 24.10.5, from 24.04.0 before 24.04.11, from 23.10.0 before 23.10.22, from 23.04.0 before 23.04.27, from 22.10.0 before 22.10.29.","status":"published","published":"2025-05-13T10:15:29.503Z","modified":"2026-06-17T09:33:40.737Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L","level":"medium","assessor":"primary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:11:07.176032Z"}],"osv":[{"id":"CVE-2025-4648","title":"A user with elevated privileges can inject XSS by altering the content of a SVG media during the submit request.","description":"The content of a SVG file, received as input \n\nin Centreon web, was not properly checked. Allows Reflected XSS.\nA user with elevated privileges can inject JS script by altering the content of a SVG media, during the submit request.\nThis issue affects web: from 24.10.0 before 24.10.5, from 24.04.0 before 24.04.11, from 23.10.0 before 23.10.22, from 23.04.0 before 23.04.27, from 22.10.0 before 22.10.29.","status":"published","published":"2025-05-13T09:45:41.519Z","modified":"2026-10-28T02:30:56.940548559Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T15:44:49.707645Z"}]}}