Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

56 records

Vendor: Centreon Component: Centreon Web Clear all filters
TI-2026-02356 CVE-2026-2751 · GHSA-rfgr-cv32-cqmh

Blind SQL injection in Centreon Web on Central Server

Priority MEDIUM 43

Blind SQL Injection via unsanitized array keys in Service Dependencies deletion.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00309 Published 2026-02-27 Fixed in 25.10.8, 24.10.20 +1 CWE-89
TI-2025-11484 CVE-2025-12513 · GHSA-6cq2-43jx-jjqp

A user with elevated privileges can inject XSS in the Hosts configuration parameters page

Priority LOW 29

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Hosts configuration form modules) allows Stored XSS to users with high privileges.

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00195 Published 2026-01-05 Fixed in 25.10.2, 24.10.15 +1 CWE-79
TI-2025-11490 CVE-2025-12519 · GHSA-m5h4-58hj-mjp9

Information disclosure on Administration parameters API endpoint

Priority LOW 30

Missing Authorization vulnerability in Centreon Infra Monitoring (Administration parameters API endpoint modules) allows Accessing Functionality Not Properly Constrained by ACLs, resulting in Information Disclosure like…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00231 Published 2026-01-05 Fixed in 25.10.2, 24.10.15 +1 CWE-862
TI-2025-11941 CVE-2025-13056 · GHSA-85gx-xr6w-3xw9

A user with elevated privileges can inject XSS in the Administration ACL Menus configuration page

Priority LOW 29

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Administration ACL menu configuration modules) allows Stored XSS to users with high…

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00195 Published 2026-01-05 Fixed in 25.10.2, 24.10.15 +1 CWE-79
TI-2025-34624 CVE-2025-54890 · GHSA-9v23-62w5-4mfm

A user with elevated privileges can inject XSS in the Hostgroups configuration page

Priority LOW 29

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Hostgroup configuration page) allows Stored XSS by users with elevated privileges.Th…

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00195 Published 2025-12-22 Fixed in 24.10.15, 24.04.19 +1 CWE-79
TI-2025-09199 CVE-2025-10023 · GHSA-9w74-q55j-hgpp

A user with elevated privileges can inject XSS in the Services Meta-services configuration page

Priority LOW 27

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Services Meta-services modules) allows Stored XSS by users with elevated privileges.…

CVSS 3.1MEDIUM 6.2 Network High privileges User interaction EPSS 0.00209 Published 2025-10-27 Fixed in 24.10.9, 24.04.16 +1 CWE-79
TI-2025-07742 CVE-2025-8459 · GHSA-qjr3-j75m-5g32

A user with low privileges can inject XSS in the Monitoring Recurrent downtimes page

Priority LOW 33

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Monitoring recurrent downtime scheduler modules) allows Stored XSS.This issue affect…

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00252 Published 2025-10-14 Fixed in 24.10.13, 24.04.18 +1 CWE-79
TI-2025-07716 CVE-2025-8430 · GHSA-q3f8-xgfv-h96x

A user with elevated privileges can inject XSS in the Commands Connectors configuration configuration page

Priority LOW 29

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Commands Connectors configuration modules) allows Stored XSS by users with elevated…

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00209 Published 2025-10-14 Fixed in 24.10.13, 24.04.18 +1 CWE-79
TI-2025-07715 CVE-2025-8429 · GHSA-98rw-7c68-7997

A user with elevated privileges can inject XSS in the ACL Action access configuration page

Priority LOW 29

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (ACL Action access configuration modules) allows Stored XSS by users with elevated pr…

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00209 Published 2025-10-14 Fixed in 24.10.13, 24.04.18 +1 CWE-79
TI-2025-34627 CVE-2025-54893 · GHSA-3gg4-vpvx-4gr9

A user with elevated privileges can inject XSS in the Hosts templates configuration page

Priority LOW 29

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Hosts templates configuration modules) allows Stored XSS by users with elevated priv…

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00209 Published 2025-10-14 Fixed in 24.10.13, 24.04.18 +1 CWE-79
TI-2025-34625 CVE-2025-54891 · GHSA-88gv-p6cx-382j

A user with elevated privileges can inject XSS in the ACL Resource Access configuration page

Priority LOW 30

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (ACL Resource access configuration modules) allows Stored XSS by users with elevated…

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00258 Published 2025-10-14 Fixed in 24.10.13, 24.04.18 +1 CWE-79
TI-2025-34626 CVE-2025-54892 · GHSA-4fwf-gvh7-mg58

A user with elevated privileges can inject XSS in the SNMP traps group configuration page

Priority LOW 30

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (SNMP traps group configuration modules) allows Stored XSS by users with elevated pri…

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00258 Published 2025-10-14 Fixed in 24.10.13, 24.04.18 +1 CWE-79
TI-2025-34623 CVE-2025-54889 · GHSA-jprc-vwq5-77h3

A user with elevated privileges can inject XSS in the SNMP traps manufacturer configuration page

Priority LOW 30

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (SNMP traps manufacturer configuration modules) allows Stored XSS by users with eleva…

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00258 Published 2025-10-14 Fixed in 24.10.13, 24.04.18 +1 CWE-79
TI-2025-05371 CVE-2025-5946 · GHSA-mpw2-f23v-c9fv

RCE via the poller reload feature available only to user with high privilege

Priority MEDIUM 54

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Centreon Infra Monitoring (Poller reload setup in the configuration modules) allows OS Command Injection.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.13508 Published 2025-10-14 Fixed in 24.10.13, 24.04.18 +1 CWE-78
TI-2025-07714 CVE-2025-8428 · GHSA-mw2j-cm2r-g4x9

XSS found in the HTTP loader widget

Priority LOW 30

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (HTTP Loader widget modules) allows Stored XSS.This issue affects Infra Monitoring: f…

CVSS 3.1MEDIUM 6.8 Network Low privileges User interaction EPSS 0.00252 Published 2025-10-14 Fixed in 24.10.13, 24.04.18 +1 CWE-79
TI-2025-06168 CVE-2025-6791 · GHSA-qxcr-3gvp-f5hh

Second order SQL injection available to user with low privilege

Priority MEDIUM 40

In the monitoring event logs page, it is possible to alter the http request to insert a reflect payload in the DB.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00337 Published 2025-08-22 Fixed in 24.10.9, 24.04.16 +1 CWE-89
TI-2025-04150 CVE-2025-4650 · GHSA-q7xg-5x7p-mh5q

SQL injection in Centreon web

Priority LOW 34

User with high privileges is able to introduce a SQLi using the Meta Service indicator page.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00405 Published 2025-08-22 Fixed in 24.10.9, 24.04.16 +1 CWE-89
TI-2025-04149 CVE-2025-4649 · GHSA-j876-75h4-8xcg

Improper handling of exceptional conditions in Centreon web

Priority LOW 23

Improper Handling of Exceptional Conditions vulnerability in Centreon web allows Privilege Escalation.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00369 Published 2025-05-13 Fixed in 24.10.4, 24.04.10 +2 CWE-755
TI-2025-03420 CVE-2025-3872 · GHSA-439q-v53m-c73v

Privilege escalation by altering payload in contact form

Priority LOW 34

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon centreon-web (User configuration form modules) allows SQL Injection.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00407 Published 2025-04-24 Fixed in 22.10.28, 23.04.25 +3 CWE-89
Load more