Skip to content
Centreon vulnerabilities
Newest
-
centreon
Authenticated SQL Injection via PHP Array Key in ACL Management (Resources & Actions) — Centreon 26.03.0
CVE-2026-11587
7.2 High
-
centreon
Broken Object Level Authorization in Users Configuration Endpoint (/centreon/api/latest/configuration/users) – Sensitive Information Disclosure
CVE-2025-12523
6.5 Medium
-
centreon
Broken Function Level Authorization — `postcommand.php` allows execution of poller post-restart commands by non-admin users
CVE-2025-13050
5.4 Medium
-
centreon infra monitoring
A user with low privileges can inject SSTI templates that can lead to RCE in open-tickets
CVE-2026-14453
9.6 Critical
-
centreon open tickets
Path traversal in Centreon Open Tickets
CVE-2026-2749
Public exploit
9.9 Critical
-
centreon open tickets on central server, web +1 more
Command Injection via CLAPI generatetraps
CVE-2026-2750
9.1 Critical
-
centreon web on central server, web +1 more
Blind SQL Injection
CVE-2026-2751
8.3 High
-
centreon awie, infra monitoring +1 more
An unauthenticated user is able to introduce SQL Injection using the Awie export module
CVE-2025-15029
EPSS 13.0%
9.8 Critical
-
centreon awie, infra monitoring +1 more
Unauthenticated configuration import allows administrative account creation using AWIE component
CVE-2025-15026
9.8 Critical
-
centreon infra monitoring, dynamic service management +1 more
A user with elevated privileges can inject XSS in the DSM Administration’s Extensions configuration page
CVE-2025-12511
6.8 Medium
-
centreon web, infra monitoring +1 more
A user with elevated privileges can inject XSS in the Hosts configuration parameters page
CVE-2025-12513
6.8 Medium
-
centreon infra monitoring, web +1 more
Information disclosure on Administration parameters API endpoint
CVE-2025-12519
5.3 Medium
-
centreon web, infra monitoring +1 more
A user with elevated privileges can inject XSS in the Administration ACL Menus configuration page
CVE-2025-13056
6.8 Medium
-
centreon infra monitoring, web +1 more
RCE via the backup feature available only to user with high privilege
CVE-2025-5965
EPSS 28.2%
7.2 High
-
centreon web, infra monitoring +1 more
A user with elevated privileges can inject XSS in the Hostgroups configuration page
CVE-2025-54890
6.8 Medium
-
centreon infra monitoring - open-tickets, open tickets +1 more
A user with elevated privileges is able to introduce a SQL Injection using the Open-tickets Notification rules configuration parameters
CVE-2025-12514
7.2 High
-
centreon infra monitoring, open tickets +1 more
A user with elevated privileges can inject XSS in the Notification rules configuration page
CVE-2025-8460
6.8 Medium
-
centreon web, infra monitoring +1 more
A user with elevated privileges can inject XSS in the Services Meta-services configuration page
CVE-2025-10023
6.2 Medium
-
centreon infra monitoring
CentreonBI user account on the MBI server can execute commands as root by modifying script runned by the CRON
CVE-2025-8432
8.4 High
-
centreon web, infra monitoring +1 more
A user with low privileges can inject XSS in the Monitoring Recurrent downtimes page
CVE-2025-8459
7.7 High
-
centreon web, infra monitoring +1 more
A user with elevated privileges can inject XSS in the Commands Connectors configuration configuration page
CVE-2025-8430
6.8 Medium
-
centreon web, infra monitoring +1 more
A user with elevated privileges can inject XSS in the ACL Action access configuration page
CVE-2025-8429
6.8 Medium
-
centreon web, infra monitoring +1 more
A user with elevated privileges can inject XSS in the Hosts templates configuration page
CVE-2025-54893
6.8 Medium
-
centreon web, infra monitoring +1 more
A user with elevated privileges can inject XSS in the ACL Resource Access configuration page
CVE-2025-54891
6.8 Medium
-
centreon web, infra monitoring +1 more
A user with elevated privileges can inject XSS in the SNMP traps group configuration page
CVE-2025-54892
6.8 Medium
-
centreon web, infra monitoring +1 more
A user with elevated privileges can inject XSS in the SNMP traps manufacturer configuration page
CVE-2025-54889
6.8 Medium
-
centreon infra monitoring, web +1 more
RCE via the poller reload feature available only to user with high privilege
CVE-2025-5946
Public exploit
EPSS 13.5%
7.2 High
-
centreon web, infra monitoring +1 more
XSS found in the HTTP loader widget
CVE-2025-8428
6.8 Medium
-
centreon web
Second order SQL injection available to user with low privilege
CVE-2025-6791
8.8 High
-
centreon web
User with high privileges is able to introduce a SQLi using the Meta Service indicator page
CVE-2025-4650
7.2 High
-
centreon web
ACL are not correctly taken into account in the display of the "event logs" page. This page requiring, high privileges, will display all available logs.
CVE-2025-4649
4.9 Medium
-
centreon web
A user with elevated privileges can inject XSS by altering the content of a SVG media during the submit request.
CVE-2025-4648
8.4 High
-
centreon web
A user with elevated privileges can bypass sanitization measures by replacing the content of an existing SVG
CVE-2025-4647
8.4 High
-
centreon web
A high privilege user is able to create and use a valid admin API token in centreon-web
CVE-2025-4646
7.2 High
-
centreon, centreon web +1 more
Privilege escalation by altering payload in contact form
CVE-2025-3872
7.2 High
-
centreon bam
SQL Injection in Centreon BAM boolean KPI listing
CVE-2025-3767
7.2 High
-
centreon web
An issue was discovered in Centreon centreon-web 24.10.x before 24.10.3, 24.04.x before 24.04.9,...
CVE-2024-55573
9.1 Critical
-
centreon web
An issue was discovered in Centreon Web 24.10.x before 24.10.3, 24.04.x before 24.04.9, 23.10.x...
CVE-2024-53923
9.1 Critical
-
centreon
An issue was discovered in Centreon centreon-open-tickets 24.10.x before 24.10.0, 24.04.x before...
CVE-2024-45756
7.2 High
-
centreon
An issue was discovered in Centreon centreon-dsm-server 24.10.x before 24.10.0, 24.04.x before 24...
CVE-2024-45755
7.2 High
-
centreon
An issue was discovered in the centreon-bi-server component in Centreon BI Server 24.04.x before...
CVE-2024-45754
7.2 High
-
centreon
A SQL injection vulnerability in Centreon 24.04.2 allows a remote high-privileged attacker to...
CVE-2024-39843
6.7 Medium
-
centreon
A SQL injection vulnerability in Centreon 24.04.2 allows a remote high-privileged attacker to...
CVE-2024-39842
7.2 High
-
centreon web
A SQL Injection vulnerability exists in the service configuration functionality in Centreon Web...
CVE-2024-39841
8.8 High
-
centreon web
A SQL Injection vulnerability exists in the Graph Template component in Centreon Web 24.04.x...
CVE-2024-33854
9.1 Critical
-
centreon web
A SQL Injection vulnerability exists in the Timeperiod component in Centreon Web 24.04.x before...
CVE-2024-33853
9.1 Critical
-
centreon web
A SQL Injection vulnerability exists in the Downtime component in Centreon Web 24.04.x before 24...
CVE-2024-33852
9.1 Critical
-
centreon, centreon web +1 more
A SQL Injection vulnerability exists in the updateServiceHost functionality in Centreon Web 24.04...
CVE-2024-32501
EPSS 19.2%
9.8 Critical
-
centreon, centreon web +1 more
Centreon initCurveList SQL Injection Remote Code Execution Vulnerability
CVE-2024-5725
EPSS 47.4%
8.8 High
-
centreon, centreon web +1 more
Centreon updateServiceHost SQL Injection Remote Code Execution Vulnerability
CVE-2024-5723
EPSS 40.7%
8.8 High
- Show olderLoading…