centreon web vulnerabilities

Latest centreon web CVEs

Newest publication first

1. CVE-2026-2750 Command Injection via CLAPI generatetraps

   Published 2026-02-27

   Critical·CVSS 9.8 EPSS 0.34%

   Improper Input Validation vulnerability in Centreon Centreon Open Tickets on Central Server on Linux (Centreon Open Tickets modules).This issue affects Centreon Open Tickets on Central Server: from all before 25.10; 24.10;24.04.

2. CVE-2025-6791 Second order SQL injection available to user with low privilege

   Published 2025-08-22

   High·CVSS 8.8 EPSS 0.36%

   In the monitoring event logs page, it is possible to alter the http request to insert a reflect payload in the DB. Caused by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon web (Monitoring event logs modules) allow...

3. CVE-2025-4650 User with high privileges is able to introduce a SQLi using the Meta Service indicator page

   Published 2025-08-22

   High·CVSS 7.2 EPSS 0.43%

   User with high privileges is able to introduce a SQLi using the Meta Service indicator page. Caused by an Improper Neutralization of Special Elements used in an SQL Command.This issue affects web: from 24.10.0 before 24.10.9, from 24.04.0 before 24.04.16, from 23.10.0 before 23.1...

4. CVE-2025-4649 ACL are not correctly taken into account in the display of the "event logs" page. This page requiring, high privileges, will display all available logs.

   Published 2025-05-13

   Medium·CVSS 4.9 EPSS 0.38%

   Improper Handling of Exceptional Conditions vulnerability in Centreon web allows Privilege Escalation. ACL are not correctly taken into account in the display of the "event logs" page. This page requiring, high privileges, will display all available logs. This issue affects web:...

5. CVE-2025-4648 A user with elevated privileges can inject XSS by altering the content of a SVG media during the submit request.

   Published 2025-05-13

   Medium·CVSS 5.9 EPSS 0.27%

   The content of a SVG file, received as input in Centreon web, was not properly checked. Allows Reflected XSS. A user with elevated privileges can inject JS script by altering the content of a SVG media, during the submit request. This issue affects web: from 24.10.0 before 24.10....

6. CVE-2025-4647 A user with elevated privileges can bypass sanitization measures by replacing the content of an existing SVG

   Published 2025-05-13

   Medium·CVSS 4.8 EPSS 0.29%

   Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon web allows Reflected XSS. A user with elevated privileges can bypass sanitization measures by replacing the content of an existing SVG. This issue affects web: fr...

7. CVE-2025-4646 A high privilege user is able to create and use a valid admin API token in centreon-web

   Published 2025-05-13

   High·CVSS 7.2 EPSS 0.46%

   Incorrect Authorization vulnerability in Centreon web (API Token creation form modules) allows Privilege Escalation.This issue affects web: from 24.04.0 before 24.04.10, from 24.10.0 before 24.10.4.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.