https://vulnogram.org/ Most recent CVEs assigned by Centreon (centreon). https://vulnogram.org/seaview/icons/centreon.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-14453 https://vulnogram.org/CVE-2026-14453 This vulnerability is a critical Server-Side Template Injection (SSTI) in Centreon's centreon-open-tickets module that leads to Remote Code Execution. The message_confirm field is stored without sanitization and rendered via Smarty with no security p… Critical Mon, 13 Jul 2026 08:19:13 GMT https://vulnogram.org/CVE-2026-2749 https://vulnogram.org/CVE-2026-2749 Vulnerability in Centreon Centreon Open Tickets on Central Server on Linux (Centroen Open Ticket modules).This issue affects Centreon Open Tickets on Central Server: from all before 25.10.3, 24.10.8, 24.04.7. Critical Fri, 27 Feb 2026 15:05:17 GMT https://vulnogram.org/CVE-2026-2750 https://vulnogram.org/CVE-2026-2750 Improper Input Validation vulnerability in Centreon Centreon Open Tickets on Central Server on Linux (Centreon Open Tickets modules).This issue affects Centreon Open Tickets on Central Server: from all before 25.10; 24.10;24.04. Critical Fri, 27 Feb 2026 14:58:29 GMT https://vulnogram.org/CVE-2026-2751 https://vulnogram.org/CVE-2026-2751 Blind SQL Injection via unsanitized array keys in Service Dependencies deletion. Vulnerability in Centreon Centreon Web on Central Server on Linux (Service Dependencies modules) allows Blind SQL Injection.This issue affects Centreon Web on Central Se… High Fri, 27 Feb 2026 13:33:44 GMT https://vulnogram.org/CVE-2025-15029 https://vulnogram.org/CVE-2025-15029 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon Infra Monitoring (Awie export modules) allows SQL Injection to unauthenticated user. This issue affects Infra Monitoring: from 25.10.0 befo… Critical Network Exploitable Mon, 05 Jan 2026 14:34:02 GMT https://vulnogram.org/CVE-2025-15026 https://vulnogram.org/CVE-2025-15026 Missing Authentication for Critical Function vulnerability in Centreon Infra Monitoring centreon-awie (Awie import module) allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Infra Monitoring: from 25.10.0 before 25.10… Critical Network Exploitable Mon, 05 Jan 2026 14:31:34 GMT https://vulnogram.org/CVE-2025-12511 https://vulnogram.org/CVE-2025-12511 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (DSM extenstio configuration modules) allows Stored XSS to user with elevated privileges. This issue affects Infra… Medium Mon, 05 Jan 2026 14:05:52 GMT https://vulnogram.org/CVE-2025-12513 https://vulnogram.org/CVE-2025-12513 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Hosts configuration form modules) allows Stored XSS to users with high privileges. This issue affects Infra Monito… Medium Mon, 05 Jan 2026 13:43:42 GMT https://vulnogram.org/CVE-2025-12519 https://vulnogram.org/CVE-2025-12519 Missing Authorization vulnerability in Centreon Infra Monitoring (Administration parameters API endpoint modules) allows Accessing Functionality Not Properly Constrained by ACLs, resulting in Information Disclosure like downtime or acknowledgement co… Medium Network Exploitable Mon, 05 Jan 2026 10:15:08 GMT https://vulnogram.org/CVE-2025-13056 https://vulnogram.org/CVE-2025-13056 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Administration ACL menu configuration modules) allows Stored XSS to users with high privileges. This issue affects… Medium Mon, 05 Jan 2026 10:10:35 GMT https://vulnogram.org/CVE-2025-5965 https://vulnogram.org/CVE-2025-5965 In the backup parameters, a user with high privilege is able to concatenate custom instructions to the backup setup. Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Centreon Infra Monitoring… High Mon, 05 Jan 2026 10:06:05 GMT https://vulnogram.org/CVE-2025-54890 https://vulnogram.org/CVE-2025-54890 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Hostgroup configuration page) allows Stored XSS by users with elevated privileges.This issue affects Infra Monitor… Medium Mon, 22 Dec 2025 11:07:28 GMT https://vulnogram.org/CVE-2025-12514 https://vulnogram.org/CVE-2025-12514 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon Infra Monitoring - Open-tickets (Notification rules configuration parameters, Open tickets modules) allows SQL Injection to user with eleva… High Mon, 22 Dec 2025 10:59:18 GMT https://vulnogram.org/CVE-2025-8460 https://vulnogram.org/CVE-2025-8460 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Notification rules, Open tickets module) allows Stored XSS by users with elevated privileges.This issue affects In… Medium Mon, 22 Dec 2025 10:55:58 GMT https://vulnogram.org/CVE-2025-10023 https://vulnogram.org/CVE-2025-10023 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Services Meta-services modules) allows Stored XSS by users with elevated privileges.This issue affects Infra Monit… Medium Mon, 27 Oct 2025 15:07:21 GMT https://vulnogram.org/CVE-2025-8432 https://vulnogram.org/CVE-2025-8432 Incorrect Default Permissions vulnerability in Centreon Infra Monitoring (MBI modules) allows Embedding Scripts within Scripts by CentreonBI user account on the MBI server This issue affects Infra Monitoring: from 24.10.0 before 24.10.6, from 24.04.0… High Mon, 27 Oct 2025 10:08:33 GMT https://vulnogram.org/CVE-2025-8459 https://vulnogram.org/CVE-2025-8459 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Monitoring recurrent downtime scheduler modules) allows Stored XSS.This issue affects Infra Monitoring: from 24.10… High Tue, 14 Oct 2025 17:11:30 GMT https://vulnogram.org/CVE-2025-8430 https://vulnogram.org/CVE-2025-8430 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Commands Connectors configuration modules) allows Stored XSS by users with elevated privileges. This issue affects… Medium Tue, 14 Oct 2025 16:54:43 GMT https://vulnogram.org/CVE-2025-8429 https://vulnogram.org/CVE-2025-8429 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (ACL Action access configuration modules) allows Stored XSS by users with elevated privileges. This issue affects I… Medium Tue, 14 Oct 2025 15:29:56 GMT https://vulnogram.org/CVE-2025-54893 https://vulnogram.org/CVE-2025-54893 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Hosts templates configuration modules) allows Stored XSS by users with elevated privileges. This issue affects Inf… Medium Tue, 14 Oct 2025 15:24:24 GMT https://vulnogram.org/CVE-2025-54891 https://vulnogram.org/CVE-2025-54891 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (ACL Resource access configuration modules) allows Stored XSS by users with elevated privileges. This issue affects… Medium Tue, 14 Oct 2025 15:07:01 GMT https://vulnogram.org/CVE-2025-54892 https://vulnogram.org/CVE-2025-54892 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (SNMP traps group configuration modules) allows Stored XSS by users with elevated privileges. This issue affects In… Medium Tue, 14 Oct 2025 14:59:10 GMT https://vulnogram.org/CVE-2025-54889 https://vulnogram.org/CVE-2025-54889 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (SNMP traps manufacturer configuration modules) allows Stored XSS by users with elevated privileges. This issue aff… Medium Tue, 14 Oct 2025 14:54:31 GMT https://vulnogram.org/CVE-2025-5946 https://vulnogram.org/CVE-2025-5946 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Centreon Infra Monitoring (Poller reload setup in the configuration modules) allows OS Command Injection. On the poller parameters page, a use… High Tue, 14 Oct 2025 14:29:00 GMT https://vulnogram.org/CVE-2025-8428 https://vulnogram.org/CVE-2025-8428 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (HTTP Loader widget modules) allows Stored XSS.This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, f… Medium Tue, 14 Oct 2025 14:22:03 GMT https://vulnogram.org/CVE-2025-6791 https://vulnogram.org/CVE-2025-6791 In the monitoring event logs page, it is possible to alter the http request to insert a reflect payload in the DB. Caused by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon web (Monito… High Fri, 22 Aug 2025 18:56:28 GMT https://vulnogram.org/CVE-2025-4650 https://vulnogram.org/CVE-2025-4650 User with high privileges is able to introduce a SQLi using the Meta Service indicator page. Caused by an Improper Neutralization of Special Elements used in an SQL Command.This issue affects web: from 24.10.0 before 24.10.9, from 24.04.0 before 24.0… High Fri, 22 Aug 2025 18:50:42 GMT https://vulnogram.org/CVE-2025-4649 https://vulnogram.org/CVE-2025-4649 Improper Handling of Exceptional Conditions vulnerability in Centreon web allows Privilege Escalation. ACL are not correctly taken into account in the display of the "event logs" page. This page requiring, high privileges, will display all available… Medium Tue, 13 May 2025 11:40:23 GMT https://vulnogram.org/CVE-2025-4648 https://vulnogram.org/CVE-2025-4648 The content of a SVG file, received as input in Centreon web, was not properly checked. Allows Reflected XSS. A user with elevated privileges can inject JS script by altering the content of a SVG media, during the submit request. This issue affects w… High Tue, 13 May 2025 09:45:41 GMT https://vulnogram.org/CVE-2025-4647 https://vulnogram.org/CVE-2025-4647 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon web allows Reflected XSS. A user with elevated privileges can bypass sanitization measures by replacing the content of an existing S… High Tue, 13 May 2025 09:31:17 GMT https://vulnogram.org/CVE-2025-4646 https://vulnogram.org/CVE-2025-4646 Incorrect Authorization vulnerability in Centreon web (API Token creation form modules) allows Privilege Escalation.This issue affects web: from 24.04.0 before 24.04.10, from 24.10.0 before 24.10.4. High Tue, 13 May 2025 09:17:35 GMT https://vulnogram.org/CVE-2025-3872 https://vulnogram.org/CVE-2025-3872 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon centreon-web (User configuration form modules) allows SQL Injection. A user with high privileges is able to become administrator by interce… High Thu, 24 Apr 2025 09:19:33 GMT https://vulnogram.org/CVE-2025-3767 https://vulnogram.org/CVE-2025-3767 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon BAM (Boolean KPi Listing modules) allows SQL Injection. This page is only accessible to authenticated users with high privileges. This issu… High Tue, 22 Apr 2025 15:16:24 GMT