Centreon
Centreon WEB: vulnerabilidades y CVE
Centreon WEB tiene 57 vulnerabilidades publicadas, 16 de ellas en los últimos 12 meses. 8 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE57
Últimos 12 meses16
Críticas8
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-2751 | Crítica (9.8) | 0.50% | — | 27 feb 2026 | Blind SQL Injection via unsanitized array keys in Service Dependencies deletion. Vulnerability in Centreon Centreon Web on Central Server on Linux (Service Dependencies modules) allows Blind SQL Injection.This issue… |
| CVE-2025-12513 | Media (4.8) | 0.19% | — | 5 ene 2026 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Hosts configuration form modules) allows Stored XSS to users with high privileges.… |
| CVE-2025-13056 | Media (4.8) | 0.19% | — | 5 ene 2026 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Administration ACL menu configuration modules) allows Stored XSS to users with high… |
| CVE-2025-12519 | Media (5.3) | 0.23% | — | 5 ene 2026 | Missing Authorization vulnerability in Centreon Infra Monitoring (Administration parameters API endpoint modules) allows Accessing Functionality Not Properly Constrained by ACLs, resulting in Information Disclosure like… |
| CVE-2025-5965 | Alta (7.2) | 29% | — | 5 ene 2026 | In the backup parameters, a user with high privilege is able to concatenate custom instructions to the backup setup. Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')… |
| CVE-2025-54890 | Media (4.8) | 0.19% | — | 22 dic 2025 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Hostgroup configuration page) allows Stored XSS by users with elevated… |
| CVE-2025-10023 | Media (4.8) | 0.21% | — | 27 oct 2025 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Services Meta-services modules) allows Stored XSS by users with elevated… |
| CVE-2025-8459 | Media (5.4) | 0.25% | — | 14 oct 2025 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Monitoring recurrent downtime scheduler modules) allows Stored XSS.This issue… |
| CVE-2025-8430 | Media (4.8) | 0.21% | — | 14 oct 2025 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Commands Connectors configuration modules) allows Stored XSS by users with elevated… |
| CVE-2025-8429 | Media (4.8) | 0.21% | — | 14 oct 2025 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (ACL Action access configuration modules) allows Stored XSS by users with elevated… |
| CVE-2025-54893 | Media (4.8) | 0.21% | — | 14 oct 2025 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Hosts templates configuration modules) allows Stored XSS by users with elevated… |
| CVE-2025-8428 | Media (5.4) | 0.25% | — | 14 oct 2025 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (HTTP Loader widget modules) allows Stored XSS.This issue affects Infra Monitoring:… |
| CVE-2025-5946 | Alta (7.2) | 14% | — | 14 oct 2025 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Centreon Infra Monitoring (Poller reload setup in the configuration modules) allows OS Command Injection. On… |
| CVE-2025-54892 | Media (4.8) | 0.26% | — | 14 oct 2025 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (SNMP traps group configuration modules) allows Stored XSS by users with elevated… |
| CVE-2025-54891 | Media (4.8) | 0.26% | — | 14 oct 2025 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (ACL Resource access configuration modules) allows Stored XSS by users with elevated… |
| CVE-2025-54889 | Media (4.8) | 0.26% | — | 14 oct 2025 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (SNMP traps manufacturer configuration modules) allows Stored XSS by users with… |
| CVE-2025-6791 | Alta (8.8) | 0.34% | — | 22 ago 2025 | In the monitoring event logs page, it is possible to alter the http request to insert a reflect payload in the DB. Caused by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')… |
| CVE-2025-4650 | Alta (7.2) | 0.40% | — | 22 ago 2025 | User with high privileges is able to introduce a SQLi using the Meta Service indicator page. Caused by an Improper Neutralization of Special Elements used in an SQL Command.This issue affects web: from 24.10.0 before… |
| CVE-2025-4649 | Media (4.9) | 0.35% | — | 13 may 2025 | Improper Handling of Exceptional Conditions vulnerability in Centreon web allows Privilege Escalation. ACL are not correctly taken into account in the display of the "event logs" page. This page requiring, high… |
| CVE-2025-4648 | Media (5.9) | 0.26% | — | 13 may 2025 | The content of a SVG file, received as input in Centreon web, was not properly checked. Allows Reflected XSS. A user with elevated privileges can inject JS script by altering the content of a SVG media, during the… |
| CVE-2025-4647 | Media (4.8) | 0.27% | — | 13 may 2025 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon web allows Reflected XSS. A user with elevated privileges can bypass sanitization measures by… |
| CVE-2025-4646 | Alta (7.2) | 0.43% | — | 13 may 2025 | Incorrect Authorization vulnerability in Centreon web (API Token creation form modules) allows Privilege Escalation.This issue affects web: from 24.04.0 before 24.04.10, from 24.10.0 before 24.10.4. |
| CVE-2025-3872 | Alta (7.2) | 0.40% | — | 24 abr 2025 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon centreon-web (User configuration form modules) allows SQL Injection. A user with high privileges is able to… |
| CVE-2024-55573 | Alta (7.2) | 1.1% | — | 23 ene 2025 | An issue was discovered in Centreon centreon-web 24.10.x before 24.10.3, 24.04.x before 24.04.9, 23.10.x before 23.10.19, 23.04.x before 23.04.24. A user with high privileges is able to inject SQL into the form used to… |
| CVE-2024-53923 | Alta (7.2) | 0.41% | — | 23 ene 2025 | An issue was discovered in Centreon Web 24.10.x before 24.10.3, 24.04.x before 24.04.9, 23.10.x before 23.10.19, 23.04.x before 23.04.24. A user with high privileges is able to achieve SQL injection in the form to… |
| CVE-2024-47863 | Media (6.2) | 0.60% | — | 22 nov 2024 | An issue was discovered in Centreon Web 24.10.x before 24.10.0, 24.04.x before 24.04.8, 23.10.x before 23.10.18, 23.04.x before 23.04.23, and 22.10.x before 22.10.26. A stored XSS was found in the user configuration… |
| CVE-2024-39841 | Alta (8.8) | 1.1% | — | 23 ago 2024 | A SQL Injection vulnerability exists in the service configuration functionality in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and 22.10.x before 22.10.23. |
| CVE-2024-33854 | Crítica (9.1) | 0.49% | — | 23 ago 2024 | A SQL Injection vulnerability exists in the Graph Template component in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and 22.10.x before 22.10.23. |
| CVE-2024-33853 | Crítica (9.1) | 0.49% | — | 23 ago 2024 | A SQL Injection vulnerability exists in the Timeperiod component in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and 22.10.x before 22.10.23. |
| CVE-2024-33852 | Crítica (9.1) | 0.49% | — | 23 ago 2024 | A SQL Injection vulnerability exists in the Downtime component in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and 22.10.x before 22.10.23. |