Centreon
60 CVEs across 17 Centreon products. Browse Centreon vulnerabilities, severities, and proof-of-concept exploits.
Centreon products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-14453 | Critical | 9.6 | 2026-07-13 | This vulnerability is a critical Server-Side Template Injection (SSTI) in Centreon's centreon-open-tickets module that leads to Remote Code Execution. The mess… |
CVE-2026-2750 | Critical | 9.1 | 2026-02-27 | Improper Input Validation vulnerability in Centreon Centreon Open Tickets on Central Server on Linux (Centreon Open Tickets modules).This issue affects Centreo… |
CVE-2026-2749 | Critical | 9.9 | 2026-02-27 | Vulnerability in Centreon Centreon Open Tickets on Central Server on Linux (Centroen Open Ticket modules).This issue affects Centreon Open Tickets on Central S… |
CVE-2026-2751 | High | 8.3 | 2026-02-27 | Blind SQL Injection via unsanitized array keys in Service Dependencies deletion. Vulnerability in Centreon Centreon Web on Central Server on Linux (Service Dep… |
CVE-2025-15029 | Critical | 9.8 | 2026-01-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon Infra Monitoring (Awie export modules) allows SQ… |
CVE-2025-15026 | Critical | 9.8 | 2026-01-05 | Missing Authentication for Critical Function vulnerability in Centreon Infra Monitoring centreon-awie (Awie import module) allows Accessing Functionality Not P… |
CVE-2025-12513 | Medium | 6.8 | 2026-01-05 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Hosts configuration for… |
CVE-2025-12511 | Medium | 6.8 | 2026-01-05 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (DSM extenstio configura… |
CVE-2025-13056 | Medium | 6.8 | 2026-01-05 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Administration ACL menu… |
CVE-2025-12519 | Medium | 5.3 | 2026-01-05 | Missing Authorization vulnerability in Centreon Infra Monitoring (Administration parameters API endpoint modules) allows Accessing Functionality Not Properly C… |
CVE-2025-5965 | High | 7.2 | 2026-01-05 | In the backup parameters, a user with high privilege is able to concatenate custom instructions to the backup setup. Improper Neutralization of Special Element… |
CVE-2025-8460 | Medium | 6.8 | 2025-12-22 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Notification rules, Ope… |
CVE-2025-54890 | Medium | 6.8 | 2025-12-22 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Hostgroup configuration… |
CVE-2025-12514 | High | 7.2 | 2025-12-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon Infra Monitoring - Open-tickets (Notification ru… |
CVE-2025-10023 | Medium | 6.2 | 2025-10-27 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Services Meta-services… |
CVE-2025-8432 | High | 8.4 | 2025-10-27 | Incorrect Default Permissions vulnerability in Centreon Infra Monitoring (MBI modules) allows Embedding Scripts within Scripts by CentreonBI user account on th… |
CVE-2025-8459 | High | 7.7 | 2025-10-14 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Monitoring recurrent do… |
CVE-2025-8430 | Medium | 6.8 | 2025-10-14 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Commands Connectors con… |
CVE-2025-8429 | Medium | 6.8 | 2025-10-14 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (ACL Action access confi… |
CVE-2025-54893 | Medium | 6.8 | 2025-10-14 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Hosts templates configu… |
CVE-2025-8428 | Medium | 6.8 | 2025-10-14 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (HTTP Loader widget modu… |
CVE-2025-5946 | High | 7.2 | 2025-10-14 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Centreon Infra Monitoring (Poller reload setup in t… |
CVE-2025-54892 | Medium | 6.8 | 2025-10-14 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (SNMP traps group config… |
CVE-2025-54891 | Medium | 6.8 | 2025-10-14 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (ACL Resource access con… |
CVE-2025-54889 | Medium | 6.8 | 2025-10-14 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (SNMP traps manufacturer… |
CVE-2025-6791 | High | 8.8 | 2025-08-22 | In the monitoring event logs page, it is possible to alter the http request to insert a reflect payload in the DB. Caused by an Improper Neutralization of Spec… |
CVE-2025-4650 | High | 7.2 | 2025-08-22 | User with high privileges is able to introduce a SQLi using the Meta Service indicator page. Caused by an Improper Neutralization of Special Elements used in a… |
CVE-2025-4649 | Medium | 4.9 | 2025-05-13 | Improper Handling of Exceptional Conditions vulnerability in Centreon web allows Privilege Escalation. ACL are not correctly taken into account in the displ… |
CVE-2025-4648 | High | 8.4 | 2025-05-13 | The content of a SVG file, received as input in Centreon web, was not properly checked. Allows Reflected XSS. A user with elevated privileges can inject JS s… |
CVE-2025-4647 | High | 8.4 | 2025-05-13 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon web allows Reflected XSS. A user with el… |
CVE-2025-4646 | High | 7.2 | 2025-05-13 | Incorrect Authorization vulnerability in Centreon web (API Token creation form modules) allows Privilege Escalation.This issue affects web: from 24.04.0 before… |
CVE-2025-3872 | High | 7.2 | 2025-04-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon centreon-web (User configuration form modules) a… |
CVE-2025-3767 | High | 7.2 | 2025-04-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon BAM (Boolean KPi Listing modules) allows SQL Inj… |
CVE-2024-55573 | Critical | 9.1 | 2025-01-23 | An issue was discovered in Centreon centreon-web 24.10.x before 24.10.3, 24.04.x before 24.04.9, 23.10.x before 23.10.19, 23.04.x before 23.04.24. A user with… |
CVE-2024-53923 | Critical | 9.1 | 2025-01-23 | An issue was discovered in Centreon Web 24.10.x before 24.10.3, 24.04.x before 24.04.9, 23.10.x before 23.10.19, 23.04.x before 23.04.24. A user with high priv… |
CVE-2024-39843 | Medium | 6.7 | 2024-09-23 | A SQL injection vulnerability in Centreon 24.04.2 allows a remote high-privileged attacker to execute arbitrary SQL command via create user form inputs. |
CVE-2024-39842 | High | 7.2 | 2024-09-23 | A SQL injection vulnerability in Centreon 24.04.2 allows a remote high-privileged attacker to execute arbitrary SQL command via user massive changes inputs. |
CVE-2024-39841 | High | 8.8 | 2024-08-23 | A SQL Injection vulnerability exists in the service configuration functionality in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before… |
CVE-2024-33854 | Critical | 9.1 | 2024-08-23 | A SQL Injection vulnerability exists in the Graph Template component in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19… |
CVE-2024-33853 | Critical | 9.1 | 2024-08-23 | A SQL Injection vulnerability exists in the Timeperiod component in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and… |
CVE-2024-33852 | Critical | 9.1 | 2024-08-23 | A SQL Injection vulnerability exists in the Downtime component in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and 22… |
CVE-2024-32501 | Critical | 9.8 | 2024-08-23 | A SQL Injection vulnerability exists in the updateServiceHost functionality in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23… |
CVE-2024-5725 | High | 8.8 | 2024-08-21 | Centreon initCurveList SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected inst… |
CVE-2024-5723 | High | 8.8 | 2024-08-21 | Centreon updateServiceHost SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2023-51633 | Critical | 9.6 | 2024-05-03 | Centreon sysName Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected ins… |
CVE-2024-23119 | High | 8.8 | 2024-04-01 | Centreon insertGraphTemplate SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affecte… |
CVE-2024-23118 | High | 7.2 | 2024-04-01 | Centreon updateContactHostCommands SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a… |
CVE-2024-23117 | High | 7.2 | 2024-04-01 | Centreon updateContactServiceCommands SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2024-23116 | High | 7.2 | 2024-04-01 | Centreon updateLCARelation SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2024-23115 | High | 7.2 | 2024-04-01 | Centreon updateGroups SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected insta… |
CVE-2024-0637 | High | 8.8 | 2024-04-01 | Centreon updateDirectory SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected in… |
CVE-2022-42429 | High | 8.8 | 2023-03-29 | This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploit this vulnerabili… |
CVE-2022-42428 | High | 8.8 | 2023-03-29 | This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploit this vulnerabili… |
CVE-2022-42427 | High | 8.8 | 2023-03-29 | This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploit this vulnerabili… |
CVE-2022-42426 | High | 8.8 | 2023-03-29 | This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploit this vulnerabili… |
CVE-2022-42425 | High | 8.8 | 2023-03-29 | This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploit this vulnerabili… |
CVE-2022-42424 | High | 8.8 | 2023-03-29 | This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploit this vulnerabili… |
CVE-2022-41142 | High | 8.8 | 2023-01-26 | This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploit this vulnerabili… |
CVE-2022-3827 | Medium | 6.3 | 2022-11-02 | A vulnerability was found in centreon. It has been declared as critical. This vulnerability affects unknown code of the file formContactGroup.php of the compon… |
CVE-2022-39988 | Medium | 5.4 | 2022-10-06 | A cross-site scripting (XSS) vulnerability in Centreon 22.04.0 allows attackers to execute arbitrary web script or HTML via a crafted payload injected into the… |
CVE-2022-40044 | Medium | 5.4 | 2022-09-26 | Centreon v20.10.18 was discovered to contain a cross-site scripting (XSS) vulnerability via the esc_name (Escalation Name) parameter at Configuration/Notificat… |
CVE-2022-40043 | High | 8.8 | 2022-09-26 | Centreon v20.10.18 was discovered to contain a SQL injection vulnerability via the esc_name (Escalation Name) parameter at Configuration/Notifications/Escalati… |
CVE-2022-36194 | Medium | 5.4 | 2022-08-29 | Centreon 22.04.0 is vulnerable to Cross Site Scripting (XSS) from the function Pollers > Broker Configuration by adding a crafted payload into the name paramet… |
CVE-2022-34872 | Medium | 6.5 | 2022-08-03 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Centreon. Authentication is required to exploit this… |
CVE-2022-34871 | High | 7.2 | 2022-08-03 | This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploit this vulnerabili… |
CVE-2020-22345 | High | 8.8 | 2021-08-18 | /graphStatus/displayServiceStatus.php in Centreon 19.10.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the RRDdatabase_… |
CVE-2021-37558 | Critical | 9.8 | 2021-08-03 | A SQL injection vulnerability in a MediaWiki script in Centreon before 20.04.14, 20.10.8, and 21.04.2 allows remote unauthenticated attackers to execute arbitr… |
CVE-2021-37557 | High | 8.8 | 2021-08-03 | A SQL injection vulnerability in image generation in Centreon before 20.04.14, 20.10.8, and 21.04.2 allows remote authenticated (but low-privileged) attackers… |
CVE-2021-37556 | High | 8.8 | 2021-08-03 | A SQL injection vulnerability in reporting export in Centreon before 20.04.14, 20.10.8, and 21.04.2 allows remote authenticated (but low-privileged) attackers… |
CVE-2021-28053 | High | 8.8 | 2021-07-16 | An issue was discovered in Centreon-Web in Centreon Platform 20.10.0. A SQL injection vulnerability in "Configuration > Users > Contacts / Users" allows remote… |
CVE-2021-28054 | Medium | 5.4 | 2021-07-16 | An issue was discovered in Centreon-Web in Centreon Platform 20.10.0. A Stored Cross-Site Scripting (XSS) issue in "Configuration > Hosts" allows remote authen… |
CVE-2021-27676 | Medium | 5.4 | 2021-05-26 | Centreon version 20.10.2 is affected by a cross-site scripting (XSS) vulnerability. The dep_description (Dependency Description) and dep_name (Dependency Name)… |
CVE-2021-26804 | Medium | 6.5 | 2021-05-04 | Insecure Permissions in Centreon Web versions 19.10.18, 20.04.8, and 20.10.2 allows remote attackers to bypass validation by changing any file extension to ".g… |
CVE-2021-28055 | Medium | 6.5 | 2021-04-15 | An issue was discovered in Centreon-Web in Centreon Platform 20.10.0. The anti-CSRF token generation is predictable, which might allow CSRF attacks that add an… |
CVE-2020-22425 | High | 8.8 | 2021-02-15 | Centreon 19.10-3.el7 is affected by a SQL injection vulnerability, where an authorized user is able to inject additional SQL queries to perform remote command… |
CVE-2020-13628 | Medium | 6.1 | 2020-05-27 | Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the widgetId parameter to host-monitoring/src/toolb… |
CVE-2020-13627 | Medium | 6.1 | 2020-05-27 | Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the widgetId parameter to service-monitoring/src/in… |
CVE-2020-10946 | Medium | 6.1 | 2020-05-27 | Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the page parameter to service-monitoring/src/index… |
CVE-2020-10945 | Medium | 4.3 | 2020-05-27 | Centreon before 19.10.7 exposes Session IDs in server responses. |
CVE-2020-13252 | High | 8.8 | 2020-05-21 | Centreon before 19.04.15 allows remote attackers to execute arbitrary OS commands by placing shell metacharacters in RRDdatabase_status_path (via a main.get.ph… |
CVE-2019-19699 | High | 7.2 | 2020-04-06 | There is Authenticated remote code execution in Centreon Infrastructure Monitoring Software through 19.10 via Pollers misconfiguration, leading to system compr… |
CVE-2019-19487 | High | 8.8 | 2020-03-20 | Command Injection in minPlayCommand.php in Centreon (19.04.4 and below) allows an attacker to achieve command injection via a plugin test. |
CVE-2019-19486 | Medium | 6.5 | 2020-03-20 | Local File Inclusion in minPlayCommand.php in Centreon (19.04.4 and below) allows an attacker to traverse paths via a plugin test. |
CVE-2019-19484 | Medium | 6.1 | 2020-03-20 | Open redirect via parameter ‘p’ in login.php in Centreon (19.04.4 and below) allows an attacker to craft a payload and execute unintended behavior. |
CVE-2019-17647 | Critical | 9.8 | 2020-03-05 | An issue was discovered in Centreon before 2.8.30, 18.10.8, 19.04.5, and 19.10.2. SQL Injection exists via the include/monitoring/status/Hosts/xml/hostXML.php… |
CVE-2019-17646 | High | 7.5 | 2020-03-05 | An issue was discovered in Centreon before 18.10.8, 19.04.5, and 19.10.2. It provides sensitive information via an unauthenticated direct request for api/exter… |
CVE-2019-17645 | High | 7.5 | 2020-03-05 | An issue was discovered in Centreon before 2.8.31, 18.10.9, 19.04.6, and 19.10.3. It provides sensitive information via an unauthenticated direct request for i… |
CVE-2019-17642 | High | 8.8 | 2020-03-05 | An issue was discovered in Centreon before 18.10.8, 19.10.1, and 19.04.2. It allows CSRF with resultant remote command execution via shell metacharacters in a… |
CVE-2019-17644 | High | 7.5 | 2020-03-04 | An issue was discovered in Centreon before 2.8-30, 18.10-8, 19.04-5, and 19.10-2.. It provides sensitive information via an unauthenticated direct request for… |
CVE-2019-17643 | High | 7.5 | 2020-03-04 | An issue was discovered in Centreon before 2.8-30,18.10-8, 19.04-5, and 19.10-2. It provides sensitive information via an unauthenticated direct request for in… |
CVE-2020-9463 | High | 8.8 | 2020-02-28 | Centreon 19.10 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the server_ip field in JSON data in an api/intern… |
CVE-2019-15299 | High | 8.8 | 2020-02-24 | An issue was discovered in Centreon Web through 19.04.3. When a user changes his password on his profile page, the contact_autologin_key field in the database… |
CVE-2019-20327 | High | 7.8 | 2020-01-16 | Insecure permissions in cwrapper_perl in Centreon Infrastructure Monitoring Software through 19.10 allow local attackers to gain privileges. (cwrapper_perl is… |
CVE-2019-15300 | High | 8.8 | 2019-11-27 | A problem was found in Centreon Web through 19.04.3. An authenticated SQL injection is present in the page include/Administration/parameters/ldap/xml/ldap_host… |
CVE-2019-15298 | High | 8.8 | 2019-11-27 | A problem was found in Centreon Web through 19.04.3. An authenticated command injection is present in the page include/configuration/configObject/traps-mibs/fo… |
CVE-2019-16195 | Medium | 6.1 | 2019-11-26 | Centreon before 2.8.30, 18.x before 18.10.8, and 19.x before 19.04.5 allows XSS via myAccount alias and name fields. |
CVE-2019-16406 | High | 7.8 | 2019-11-21 | Centreon Web 19.04.4 has weak permissions within the OVA (aka VMware virtual machine) and OVF (aka VirtualBox virtual machine) files, allowing attackers to gai… |
CVE-2019-16405 | High | 7.2 | 2019-11-21 | Centreon Web before 2.8.30, 18.10.x before 18.10.8, 19.04.x before 19.04.5 and 19.10.x before 19.10.2 allows Remote Code Execution by an administrator who can… |
CVE-2019-17501 | High | 8.8 | 2019-10-14 | Centreon 19.04 allows attackers to execute arbitrary OS commands via the Command Line field of main.php?p=60807&type=4 (aka the Configuration > Commands > Disc… |
CVE-2019-17105 | Medium | 5.3 | 2019-10-08 | The token generator in index.php in Centreon Web before 2.8.27 is predictable. |