Centreon

Records131All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical22CVSS 9.0–10.0

CVSS high64CVSS 7.0–8.9

Exploited now

Centreon records in CISA KEV

No Centreon vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Centreon 59 records HIGH Centreon Web 56 records HIGH Centreon Host-monitoring Widget 3 records LOW Centreon Service-monitoring Widget 3 records LOW Centreon Tactical-overview Widget 3 records LOW Open Tickets 3 records MEDIUM Awie 2 records MEDIUM Centreon Vm 2 records MEDIUM

Records

56 records in Centreon Web · all components

TI-2024-00588 CVE-2024-0637 · GHSA-22v7-v3mj-pm8r

SQL injection in Centreon

HIGH 78

Centreon updateDirectory SQL Injection Remote Code Execution Vulnerability.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.72319 Published 2024-04-01 Fixed in 22.10.15 CWE-89

TI-2024-15236 CVE-2024-23115 · GHSA-qjvm-p5vg-437c

SQL injection in Centreon

HIGH 70

Centreon updateGroups SQL Injection Remote Code Execution Vulnerability.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.67493 Published 2024-04-01 Fixed in 22.10.15 CWE-89

TI-2024-05319 CVE-2024-5725 · GHSA-67c5-gg2x-j6wg

SQL injection in Centreon

HIGH 70

Centreon initCurveList SQL Injection Remote Code Execution Vulnerability.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.47368 Published 2024-08-21 No fix listed CWE-89

TI-2024-05317 CVE-2024-5723 · GHSA-g6mm-5rjg-vwhr

SQL injection in Centreon

HIGH 68

Centreon updateServiceHost SQL Injection Remote Code Execution Vulnerability.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.40669 Published 2024-08-21 No fix listed CWE-89

TI-2024-21388 CVE-2024-32501 · GHSA-6fcq-8rv2-rc2j

A SQL Injection vulnerability exists in the updateServiceHost functionality in Centreon…

HIGH 67

A SQL Injection vulnerability exists in the updateServiceHost functionality in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and 22.10.x before 22.10.23.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.19187 Published 2024-08-23 No fix listed CWE-89

TI-2024-15239 CVE-2024-23118 · GHSA-2j4g-v4fv-rhwg

SQL injection in Centreon

HIGH 66

Centreon updateContactHostCommands SQL Injection Remote Code Execution Vulnerability.

CVSS 3.0HIGH 7.2 Network High privileges No interaction EPSS 0.53411 Published 2024-04-01 Fixed in 22.10.15 CWE-89

TI-2024-15238 CVE-2024-23117 · GHSA-j8hg-v5qv-9m28

SQL injection in Centreon

HIGH 66

Centreon updateContactServiceCommands SQL Injection Remote Code Execution Vulnerability.

CVSS 3.0HIGH 7.2 Network High privileges No interaction EPSS 0.53411 Published 2024-04-01 Fixed in 22.10.15 CWE-89

TI-2024-15237 CVE-2024-23116 · GHSA-j4pc-vqvc-4p9x

SQL injection in Centreon

HIGH 66

Centreon updateLCARelation SQL Injection Remote Code Execution Vulnerability.

CVSS 3.0HIGH 7.2 Network High privileges No interaction EPSS 0.53411 Published 2024-04-01 Fixed in 22.10.15 CWE-89

TI-2019-11408 CVE-2019-15298 · GHSA-xr82-vj36-ch3w

A problem was found in Centreon Web through 19.04.3.

MEDIUM 60

A problem was found in Centreon Web through 19.04.3.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.26624 Published 2019-11-27 No fix listed CWE-78

TI-2025-05388 CVE-2025-5965 · GHSA-4vv3-prpf-hx46

RCE via the backup feature available only to user with high privilege

MEDIUM 56

In the backup parameters, a user with high privilege is able to concatenate custom instructions to the backup setup.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.28229 Published 2026-01-05 Fixed in 25.10.2, 24.10.15 +1 CWE-78

TI-2025-05371 CVE-2025-5946 · GHSA-mpw2-f23v-c9fv

RCE via the poller reload feature available only to user with high privilege

MEDIUM 54

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Centreon Infra Monitoring (Poller reload setup in the configuration modules) allows OS Command Injection.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.13508 Published 2025-10-14 Fixed in 24.10.13, 24.04.18 +1 CWE-78

TI-2019-12336 CVE-2019-16405 · GHSA-4f26-v6fr-9hmp

Centreon Web before 2.8.30, 18.10.x before 18.10.8, 19.04.x before 19.04.5 and 19.10.x…

MEDIUM 54

Centreon Web before 2.8.30, 18.10.x before 18.10.8, 19.04.x before 19.04.5 and 19.10.x before 19.10.2 allows Remote Code Execution by an administrator who can modify Macro Expression location settings.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.27002 Published 2019-11-21 Fixed in 18.10.8, 19.04.5 CWE-20

TI-2018-08290 CVE-2018-11587 · GHSA-c8qc-cp8v-prpx

There is Remote Code Execution in Centreon 3.4.6 including Centreon Web 2.8.23 via the…

MEDIUM 49

There is Remote Code Execution in Centreon 3.4.6 including Centreon Web 2.8.23 via the RPN value in the Virtual Metric form in centreonGraph.class.php.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.04182 Published 2018-06-25 Fixed in 2.8.24 CWE-94

TI-2024-22337 CVE-2024-33854 · GHSA-vcw3-hwj8-8j82

A SQL Injection vulnerability exists in the Graph Template component in Centreon Web…

MEDIUM 48

A SQL Injection vulnerability exists in the Graph Template component in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and 22.10.x before 22.10.23.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00488 Published 2024-08-23 No fix listed CWE-89

TI-2024-22336 CVE-2024-33853 · GHSA-65h6-4ccg-v5j8

A SQL Injection vulnerability exists in the Timeperiod component in Centreon Web 24.04.x…

MEDIUM 48

A SQL Injection vulnerability exists in the Timeperiod component in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and 22.10.x before 22.10.23.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00488 Published 2024-08-23 No fix listed CWE-89

TI-2024-22335 CVE-2024-33852 · GHSA-36gx-rqg5-2fh6

A SQL Injection vulnerability exists in the Downtime component in Centreon Web 24.04.x…

MEDIUM 48

A SQL Injection vulnerability exists in the Downtime component in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and 22.10.x before 22.10.23.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00488 Published 2024-08-23 No fix listed CWE-89

TI-2018-08292 CVE-2018-11589 · GHSA-c22h-75xf-5xm9

Multiple SQL injection vulnerabilities in Centreon 3.4.6 including Centreon Web 2.8.23…

MEDIUM 46

Multiple SQL injection vulnerabilities in Centreon 3.4.6 including Centreon Web 2.8.23 allow attacks via the searchU parameter in viewLogs.php, the id parameter in GetXmlHost.php, the chartId parameter in ExportCSVServic…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02114 Published 2018-06-25 No fix listed CWE-89

TI-2023-28284 CVE-2023-51633 · GHSA-74f2-3wmr-p493

Cross-site scripting in Centreon

MEDIUM 45

Centreon sysName Cross-Site Scripting Remote Code Execution Vulnerability.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.0109 Published 2024-05-03 No fix listed CWE-79

TI-2024-36893 CVE-2024-55573 · GHSA-gq6v-gg7f-p4rm

An issue was discovered in Centreon centreon-web 24.10.x before 24.10.3, 24.04.x before…

MEDIUM 44

An issue was discovered in Centreon centreon-web 24.10.x before 24.10.3, 24.04.x before 24.04.9, 23.10.x before 23.10.19, 23.04.x before 23.04.24.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.01154 Published 2025-01-23 No fix listed CWE-89

TI-2019-12763 CVE-2019-17107 · GHSA-w648-9w29-r2jg

minPlayCommand.php in Centreon Web before 2.8.27 allows authenticated attackers to…

MEDIUM 44

minPlayCommand.php in Centreon Web before 2.8.27 allows authenticated attackers to execute arbitrary code via the command_hostaddress parameter.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0357 Published 2019-10-08 No fix listed CWE-78

TI-2018-14985 CVE-2018-21023 · GHSA-9qjx-v3p5-xfrf

getStats.php in Centreon Web before 2.8.28 allows authenticated attackers to execute…

MEDIUM 44

getStats.php in Centreon Web before 2.8.28 allows authenticated attackers to execute arbitrary code via the ns_id parameter.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02995 Published 2019-10-08 No fix listed CWE-94

TI-2026-02356 CVE-2026-2751 · GHSA-rfgr-cv32-cqmh

Blind SQL injection in Centreon Web on Central Server

MEDIUM 43

Blind SQL Injection via unsanitized array keys in Service Dependencies deletion.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00309 Published 2026-02-27 Fixed in 25.10.8, 24.10.20 +1 CWE-89

TI-2024-15240 CVE-2024-23119 · GHSA-626r-cj47-p49g

SQL injection in Centreon

MEDIUM 43

Centreon insertGraphTemplate SQL Injection Remote Code Execution Vulnerability.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.0136 Published 2024-04-01 Fixed in 22.10.15 CWE-89

TI-2024-36092 CVE-2024-53923 · GHSA-g623-4877-q5wj

An issue was discovered in Centreon Web 24.10.x before 24.10.3, 24.04.x before 24.04.9…

MEDIUM 42

An issue was discovered in Centreon Web 24.10.x before 24.10.3, 24.04.x before 24.04.9, 23.10.x before 23.10.19, 23.04.x before 23.04.24.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00427 Published 2025-01-23 No fix listed CWE-89

TI-2024-26754 CVE-2024-39841 · GHSA-58cw-gjp7-8mm7

A SQL Injection vulnerability exists in the service configuration functionality in…

MEDIUM 42

A SQL Injection vulnerability exists in the service configuration functionality in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and 22.10.x before 22.10.23.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01133 Published 2024-08-23 No fix listed CWE-89

Open these records in search →