Centreon Web
Monthly
Blind SQL injection in Centreon Web's Service Dependencies module allows authenticated attackers to extract sensitive database information through unsanitized array keys in deletion requests. This vulnerability affects Centreon Web versions before 25.10.8, 24.10.20, and 24.04.24 on Linux systems, requiring valid credentials but no user interaction to exploit. No patch is currently available, leaving affected deployments vulnerable to database reconnaissance and potential data exfiltration.
Authenticated OS command injection in Centreon Web (Infra Monitoring) lets a high-privilege user execute arbitrary operating-system commands by concatenating shell metacharacters and custom instructions into the poller reload command on the poller parameters/configuration page. Exploitation is gated on administrative privilege (CVSS PR:H, AV:N), so anonymous or low-privilege users cannot reach the vulnerable functionality, but a successful abuse yields full compromise of the poller host with high confidentiality, integrity, and availability impact. The issue affects Infra Monitoring 23.10.0 through 23.10.27, 24.04.0 through 24.04.17, and 24.10.0 through 24.10.12; EPSS is elevated at 13.51% (96th percentile), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Hosts configuration form modules) allows Stored XSS to users with high privileges. [CVSS 6.8 MEDIUM]
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Administration ACL menu configuration modules) allows Stored XSS to users with high privileges. [CVSS 6.8 MEDIUM]
Missing Authorization vulnerability in Centreon Infra Monitoring (Administration parameters API endpoint modules) allows Accessing Functionality Not Properly Constrained by ACLs, resulting in Information Disclosure like downtime or acknowledgement configurations. [CVSS 5.3 MEDIUM]
In the backup parameters, a user with high privilege is able to concatenate custom instructions to the backup setup. [CVSS 7.2 HIGH]
Stored cross-site scripting in Centreon Infra Monitoring (Centreon Web) allows authenticated users with elevated privileges to inject persistent scripts into the Hostgroup configuration page, which may execute in the context of other administrators who view the affected page. Affected versions are 24.10.0 before 24.10.15, 24.04.0 before 24.04.19, and 23.10.0 before 23.10.29; the vendor has released patched versions. No public exploit code has been identified at time of analysis, and EPSS is low at 0.19% (9th percentile), consistent with a medium-to-low priority issue.
Stored cross-site scripting in the Services and Meta-services modules of Centreon Infra Monitoring lets an authenticated user with elevated (administrative/configuration) privileges inject persistent JavaScript that executes in the browser of any other user who later opens the affected service or meta-service page. Deployments running 24.10.0 before 24.10.9, 24.04.0 before 24.04.16, or 23.10.0 before 23.10.26 are affected; patched builds are not. Exploitation requires PR:H privileges plus a second user viewing the injected content (UI:R), so the practical reach is limited and no public exploit has been identified at time of analysis; EPSS is 0.21% (roughly the 10th percentile), and there is no confirmed active exploitation (CISA KEV).
Stored cross-site scripting in the Centreon Infra Monitoring recurrent downtime scheduler module lets an authenticated operator inject persistent JavaScript that executes in the browser of any user who later views the affected downtime configuration page. Only Infra Monitoring branches 24.10.0 through 24.10.12, 24.04.0 through 24.04.17, and 23.10.0 through 23.10.27 are affected; instances on 24.10.13, 24.04.18, 23.10.28 or later are not vulnerable. Exploitation requires a valid account with rights to create or edit recurrent downtime entries plus a victim who renders the page (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), and there is no public exploit identified at time of analysis - EPSS is a low 0.25% (15th percentile) and the issue is not in CISA KEV.
Stored cross-site scripting (XSS) in the Commands Connectors configuration modules of Centreon Web (Centreon Infra Monitoring) allows an authenticated user with elevated or administrative privileges to persist malicious script content that executes when another user later loads the affected configuration page. The issue affects three branches: 23.10.0 through 23.10.27, 24.04.0 through 24.04.17, and 24.10.0 through 24.10.12. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV; EPSS is 0.21% (10th percentile), reflecting a low-priority, medium-severity issue rather than an urgent one, since exploitation is gated by a high-privilege account plus victim interaction.
Stored cross-site scripting in Centreon Infra Monitoring (Centreon Web) versions 24.10.0 through 24.10.12, 24.04.0 through 24.04.17, and 23.10.0 through 23.10.27 allows an attacker who already holds elevated/administrative privileges to persist malicious script into ACL Action access configuration modules, which then runs in the browser of a second user who views the poisoned configuration page. The CVSS 3.1 score of 4.8 (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) reflects the high-privilege prerequisite and the required victim interaction, EPSS is low at 0.21 percent (10th percentile), and no public exploit code or CISA KEV entry was identified at time of analysis. Vendor-fixed releases 24.10.13, 24.04.18, and 23.10.28 are available, so this remains a medium/low priority issue rather than an urgent one.
Stored cross-site scripting in Centreon Infra Monitoring allows an authenticated operator holding elevated privileges (PR:H) who can edit Hosts templates configuration to persist malicious script that only executes when a second user (UI:R) later opens the affected configuration page. Affected releases are 24.10.x before 24.10.13, 24.04.x before 24.04.18, and 23.10.x before 23.10.28 across Centreon Web. No public exploit code has been identified at time of analysis and EPSS is low (0.21%, 10th percentile); this is a limited-blast-radius, low-to-moderate priority issue rather than an emergency, since exploitation demands an already-trusted privileged account plus victim interaction.
Stored cross-site scripting in Centreon Infra Monitoring's HTTP Loader widget allows an authenticated user holding only low privileges (PR:L) to plant a malicious payload that executes in another user's browser when that victim opens the affected dashboard widget (UI:R), rated CVSS 5.4. Deployments are affected across three branches: 24.10.0 through 24.10.12, 24.04.0 through 24.04.17, and 23.10.0 through 23.10.27. Exploitation is constrained by the need for a valid account able to configure the widget plus a separate user who later views it, and impact is confined to the victim's browser session rather than the Centreon server; EPSS is low at 0.25% (15th percentile) and no public exploit has been identified at time of analysis.
Stored cross-site scripting (CWE-79) in Centreon Infra Monitoring's SNMP traps group configuration module lets an authenticated user with elevated/administrative privileges persist malicious script that executes in the browser of another user who later views the affected configuration page. Only Centreon Web / Infra Monitoring releases 24.10.0 through 24.10.12, 24.04.0 through 24.04.17, and 23.10.0 through 23.10.27 are affected; versions 24.10.13, 24.04.18, and 23.10.28 and later contain the fix. The issue is rated medium (CVSS 4.8, vector AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) and, because the injector must already hold high privileges and a separate victim must be induced to load the poisoned page, exploitation is realistically confined to insider or post-compromise scenarios; no public exploit code has been identified at time of analysis and EPSS is only 0.26% (16th percentile).
Stored cross-site scripting in Centreon Web (Infra Monitoring) allows a user who already holds elevated/administrative Centreon privileges to plant a persistent script payload through the ACL Resource access configuration modules. The script then executes in the browser of any other user who subsequently opens the poisoned configuration page, which means exploitation requires both an authenticated high-privilege account (PR:H) and victim interaction (UI:R) after the payload is stored. Impact is limited to script execution in the victim's browser context (S:C, C:L/I:L/A:N), yielding a CVSS of 4.8; there is no evidence of public exploit code or confirmed active exploitation, and EPSS is low at 0.26% (16th percentile), consistent with a genuine medium/low-priority issue rather than an urgent one.
Stored cross-site scripting in the SNMP traps manufacturer configuration module of Centreon Infra Monitoring allows a user who already holds elevated (administrative) privileges to persist malicious script content that executes in the browser of another privileged user who later views the affected configuration page. The network attack vector is offset by the requirement for a high-privileged authenticated account (PR:H) plus a second user's interaction (UI:R), which is why this is assessed as medium severity (CVSS 4.8) rather than urgent, with an EPSS score of only 0.26% (16th percentile) and no public exploit identified at time of analysis. Deployments running Infra Monitoring 24.10.0-24.10.12, 24.04.0-24.04.17, or 23.10.0-23.10.27 are affected; versions 24.10.13, 24.04.18, and 23.10.28 resolve the issue.
In the monitoring event logs page, it is possible to alter the http request to insert a reflect payload in the DB. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
User with high privileges is able to introduce a SQLi using the Meta Service indicator page. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Handling of Exceptional Conditions vulnerability in Centreon web allows Privilege Escalation. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The content of a SVG file, received as input in Centreon web, was not properly checked. Rated high severity (CVSS 8.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon web allows Reflected XSS. Rated high severity (CVSS 8.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Incorrect Authorization vulnerability in Centreon web (API Token creation form modules) allows Privilege Escalation.04.0 before 24.04.10, from 24.10.0 before 24.10.4. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon centreon-web (User configuration form modules) allows SQL Injection. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An issue was discovered in Centreon centreon-web 24.10.x before 24.10.3, 24.04.x before 24.04.9, 23.10.x before 23.10.19, 23.04.x before 23.04.24. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An issue was discovered in Centreon Web 24.10.x before 24.10.3, 24.04.x before 24.04.9, 23.10.x before 23.10.19, 23.04.x before 23.04.24. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A SQL Injection vulnerability exists in the service configuration functionality in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and 22.10.x before 22.10.23. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A SQL Injection vulnerability exists in the Graph Template component in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and 22.10.x before 22.10.23. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A SQL Injection vulnerability exists in the Timeperiod component in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and 22.10.x before 22.10.23. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A SQL Injection vulnerability exists in the Downtime component in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and 22.10.x before 22.10.23. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A SQL Injection vulnerability exists in the updateServiceHost functionality in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and 22.10.x before 22.10.23. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Centreon initCurveList SQL Injection Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Centreon updateServiceHost SQL Injection Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Centreon insertGraphTemplate SQL Injection Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Centreon updateContactHostCommands SQL Injection Remote Code Execution Vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
Centreon updateContactServiceCommands SQL Injection Remote Code Execution Vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
Centreon updateLCARelation SQL Injection Remote Code Execution Vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
Centreon updateGroups SQL Injection Remote Code Execution Vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
Centreon updateDirectory SQL Injection Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Insecure Permissions in Centreon Web versions 19.10.18, 20.04.8, and 20.10.2 allows remote attackers to bypass validation by changing any file extension to ".gif", then uploading it in the. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A problem was found in Centreon Web through 19.04.3. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.
A problem was found in Centreon Web through 19.04.3. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Centreon Web 19.04.4 has weak permissions within the OVA (aka VMware virtual machine) and OVF (aka VirtualBox virtual machine) files, allowing attackers to gain privileges via a Trojan horse. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Centreon Web before 2.8.30, 18.10.x before 18.10.8, 19.04.x before 19.04.5 and 19.10.x before 19.10.2 allows Remote Code Execution by an administrator who can modify Macro Expression location. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The token generator in index.php in Centreon Web before 2.8.27 is predictable. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Local file inclusion in brokerPerformance.php in Centreon Web before 2.8.28 allows attackers to disclose information or perform a stored XSS attack on a user. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
minPlayCommand.php in Centreon Web before 2.8.27 allows authenticated attackers to execute arbitrary code via the command_hostaddress parameter. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
In Centreon Web through 2.8.29, disclosure of external components' passwords allows authenticated attackers to move laterally to external components. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Multiple SQL injection vulnerabilities in Centreon 3.4.6 including Centreon Web 2.8.23 allow attacks via the searchU parameter in viewLogs.php, the id parameter in GetXmlHost.php, the chartId. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Centreon 3.4.6 including Centreon Web 2.8.23 is vulnerable to an authenticated user injecting a payload into the username or command description, resulting in stored XSS. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
There is Remote Code Execution in Centreon 3.4.6 including Centreon Web 2.8.23 via the RPN value in the Virtual Metric form in centreonGraph.class.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Blind SQL injection in Centreon Web's Service Dependencies module allows authenticated attackers to extract sensitive database information through unsanitized array keys in deletion requests. This vulnerability affects Centreon Web versions before 25.10.8, 24.10.20, and 24.04.24 on Linux systems, requiring valid credentials but no user interaction to exploit. No patch is currently available, leaving affected deployments vulnerable to database reconnaissance and potential data exfiltration.
Authenticated OS command injection in Centreon Web (Infra Monitoring) lets a high-privilege user execute arbitrary operating-system commands by concatenating shell metacharacters and custom instructions into the poller reload command on the poller parameters/configuration page. Exploitation is gated on administrative privilege (CVSS PR:H, AV:N), so anonymous or low-privilege users cannot reach the vulnerable functionality, but a successful abuse yields full compromise of the poller host with high confidentiality, integrity, and availability impact. The issue affects Infra Monitoring 23.10.0 through 23.10.27, 24.04.0 through 24.04.17, and 24.10.0 through 24.10.12; EPSS is elevated at 13.51% (96th percentile), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Hosts configuration form modules) allows Stored XSS to users with high privileges. [CVSS 6.8 MEDIUM]
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Administration ACL menu configuration modules) allows Stored XSS to users with high privileges. [CVSS 6.8 MEDIUM]
Missing Authorization vulnerability in Centreon Infra Monitoring (Administration parameters API endpoint modules) allows Accessing Functionality Not Properly Constrained by ACLs, resulting in Information Disclosure like downtime or acknowledgement configurations. [CVSS 5.3 MEDIUM]
In the backup parameters, a user with high privilege is able to concatenate custom instructions to the backup setup. [CVSS 7.2 HIGH]
Stored cross-site scripting in Centreon Infra Monitoring (Centreon Web) allows authenticated users with elevated privileges to inject persistent scripts into the Hostgroup configuration page, which may execute in the context of other administrators who view the affected page. Affected versions are 24.10.0 before 24.10.15, 24.04.0 before 24.04.19, and 23.10.0 before 23.10.29; the vendor has released patched versions. No public exploit code has been identified at time of analysis, and EPSS is low at 0.19% (9th percentile), consistent with a medium-to-low priority issue.
Stored cross-site scripting in the Services and Meta-services modules of Centreon Infra Monitoring lets an authenticated user with elevated (administrative/configuration) privileges inject persistent JavaScript that executes in the browser of any other user who later opens the affected service or meta-service page. Deployments running 24.10.0 before 24.10.9, 24.04.0 before 24.04.16, or 23.10.0 before 23.10.26 are affected; patched builds are not. Exploitation requires PR:H privileges plus a second user viewing the injected content (UI:R), so the practical reach is limited and no public exploit has been identified at time of analysis; EPSS is 0.21% (roughly the 10th percentile), and there is no confirmed active exploitation (CISA KEV).
Stored cross-site scripting in the Centreon Infra Monitoring recurrent downtime scheduler module lets an authenticated operator inject persistent JavaScript that executes in the browser of any user who later views the affected downtime configuration page. Only Infra Monitoring branches 24.10.0 through 24.10.12, 24.04.0 through 24.04.17, and 23.10.0 through 23.10.27 are affected; instances on 24.10.13, 24.04.18, 23.10.28 or later are not vulnerable. Exploitation requires a valid account with rights to create or edit recurrent downtime entries plus a victim who renders the page (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), and there is no public exploit identified at time of analysis - EPSS is a low 0.25% (15th percentile) and the issue is not in CISA KEV.
Stored cross-site scripting (XSS) in the Commands Connectors configuration modules of Centreon Web (Centreon Infra Monitoring) allows an authenticated user with elevated or administrative privileges to persist malicious script content that executes when another user later loads the affected configuration page. The issue affects three branches: 23.10.0 through 23.10.27, 24.04.0 through 24.04.17, and 24.10.0 through 24.10.12. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV; EPSS is 0.21% (10th percentile), reflecting a low-priority, medium-severity issue rather than an urgent one, since exploitation is gated by a high-privilege account plus victim interaction.
Stored cross-site scripting in Centreon Infra Monitoring (Centreon Web) versions 24.10.0 through 24.10.12, 24.04.0 through 24.04.17, and 23.10.0 through 23.10.27 allows an attacker who already holds elevated/administrative privileges to persist malicious script into ACL Action access configuration modules, which then runs in the browser of a second user who views the poisoned configuration page. The CVSS 3.1 score of 4.8 (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) reflects the high-privilege prerequisite and the required victim interaction, EPSS is low at 0.21 percent (10th percentile), and no public exploit code or CISA KEV entry was identified at time of analysis. Vendor-fixed releases 24.10.13, 24.04.18, and 23.10.28 are available, so this remains a medium/low priority issue rather than an urgent one.
Stored cross-site scripting in Centreon Infra Monitoring allows an authenticated operator holding elevated privileges (PR:H) who can edit Hosts templates configuration to persist malicious script that only executes when a second user (UI:R) later opens the affected configuration page. Affected releases are 24.10.x before 24.10.13, 24.04.x before 24.04.18, and 23.10.x before 23.10.28 across Centreon Web. No public exploit code has been identified at time of analysis and EPSS is low (0.21%, 10th percentile); this is a limited-blast-radius, low-to-moderate priority issue rather than an emergency, since exploitation demands an already-trusted privileged account plus victim interaction.
Stored cross-site scripting in Centreon Infra Monitoring's HTTP Loader widget allows an authenticated user holding only low privileges (PR:L) to plant a malicious payload that executes in another user's browser when that victim opens the affected dashboard widget (UI:R), rated CVSS 5.4. Deployments are affected across three branches: 24.10.0 through 24.10.12, 24.04.0 through 24.04.17, and 23.10.0 through 23.10.27. Exploitation is constrained by the need for a valid account able to configure the widget plus a separate user who later views it, and impact is confined to the victim's browser session rather than the Centreon server; EPSS is low at 0.25% (15th percentile) and no public exploit has been identified at time of analysis.
Stored cross-site scripting (CWE-79) in Centreon Infra Monitoring's SNMP traps group configuration module lets an authenticated user with elevated/administrative privileges persist malicious script that executes in the browser of another user who later views the affected configuration page. Only Centreon Web / Infra Monitoring releases 24.10.0 through 24.10.12, 24.04.0 through 24.04.17, and 23.10.0 through 23.10.27 are affected; versions 24.10.13, 24.04.18, and 23.10.28 and later contain the fix. The issue is rated medium (CVSS 4.8, vector AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) and, because the injector must already hold high privileges and a separate victim must be induced to load the poisoned page, exploitation is realistically confined to insider or post-compromise scenarios; no public exploit code has been identified at time of analysis and EPSS is only 0.26% (16th percentile).
Stored cross-site scripting in Centreon Web (Infra Monitoring) allows a user who already holds elevated/administrative Centreon privileges to plant a persistent script payload through the ACL Resource access configuration modules. The script then executes in the browser of any other user who subsequently opens the poisoned configuration page, which means exploitation requires both an authenticated high-privilege account (PR:H) and victim interaction (UI:R) after the payload is stored. Impact is limited to script execution in the victim's browser context (S:C, C:L/I:L/A:N), yielding a CVSS of 4.8; there is no evidence of public exploit code or confirmed active exploitation, and EPSS is low at 0.26% (16th percentile), consistent with a genuine medium/low-priority issue rather than an urgent one.
Stored cross-site scripting in the SNMP traps manufacturer configuration module of Centreon Infra Monitoring allows a user who already holds elevated (administrative) privileges to persist malicious script content that executes in the browser of another privileged user who later views the affected configuration page. The network attack vector is offset by the requirement for a high-privileged authenticated account (PR:H) plus a second user's interaction (UI:R), which is why this is assessed as medium severity (CVSS 4.8) rather than urgent, with an EPSS score of only 0.26% (16th percentile) and no public exploit identified at time of analysis. Deployments running Infra Monitoring 24.10.0-24.10.12, 24.04.0-24.04.17, or 23.10.0-23.10.27 are affected; versions 24.10.13, 24.04.18, and 23.10.28 resolve the issue.
In the monitoring event logs page, it is possible to alter the http request to insert a reflect payload in the DB. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
User with high privileges is able to introduce a SQLi using the Meta Service indicator page. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Handling of Exceptional Conditions vulnerability in Centreon web allows Privilege Escalation. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The content of a SVG file, received as input in Centreon web, was not properly checked. Rated high severity (CVSS 8.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon web allows Reflected XSS. Rated high severity (CVSS 8.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Incorrect Authorization vulnerability in Centreon web (API Token creation form modules) allows Privilege Escalation.04.0 before 24.04.10, from 24.10.0 before 24.10.4. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon centreon-web (User configuration form modules) allows SQL Injection. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An issue was discovered in Centreon centreon-web 24.10.x before 24.10.3, 24.04.x before 24.04.9, 23.10.x before 23.10.19, 23.04.x before 23.04.24. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An issue was discovered in Centreon Web 24.10.x before 24.10.3, 24.04.x before 24.04.9, 23.10.x before 23.10.19, 23.04.x before 23.04.24. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A SQL Injection vulnerability exists in the service configuration functionality in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and 22.10.x before 22.10.23. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A SQL Injection vulnerability exists in the Graph Template component in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and 22.10.x before 22.10.23. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A SQL Injection vulnerability exists in the Timeperiod component in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and 22.10.x before 22.10.23. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A SQL Injection vulnerability exists in the Downtime component in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and 22.10.x before 22.10.23. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A SQL Injection vulnerability exists in the updateServiceHost functionality in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and 22.10.x before 22.10.23. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Centreon initCurveList SQL Injection Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Centreon updateServiceHost SQL Injection Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Centreon insertGraphTemplate SQL Injection Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Centreon updateContactHostCommands SQL Injection Remote Code Execution Vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
Centreon updateContactServiceCommands SQL Injection Remote Code Execution Vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
Centreon updateLCARelation SQL Injection Remote Code Execution Vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
Centreon updateGroups SQL Injection Remote Code Execution Vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
Centreon updateDirectory SQL Injection Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Insecure Permissions in Centreon Web versions 19.10.18, 20.04.8, and 20.10.2 allows remote attackers to bypass validation by changing any file extension to ".gif", then uploading it in the. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A problem was found in Centreon Web through 19.04.3. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.
A problem was found in Centreon Web through 19.04.3. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Centreon Web 19.04.4 has weak permissions within the OVA (aka VMware virtual machine) and OVF (aka VirtualBox virtual machine) files, allowing attackers to gain privileges via a Trojan horse. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Centreon Web before 2.8.30, 18.10.x before 18.10.8, 19.04.x before 19.04.5 and 19.10.x before 19.10.2 allows Remote Code Execution by an administrator who can modify Macro Expression location. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The token generator in index.php in Centreon Web before 2.8.27 is predictable. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Local file inclusion in brokerPerformance.php in Centreon Web before 2.8.28 allows attackers to disclose information or perform a stored XSS attack on a user. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
minPlayCommand.php in Centreon Web before 2.8.27 allows authenticated attackers to execute arbitrary code via the command_hostaddress parameter. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
In Centreon Web through 2.8.29, disclosure of external components' passwords allows authenticated attackers to move laterally to external components. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Multiple SQL injection vulnerabilities in Centreon 3.4.6 including Centreon Web 2.8.23 allow attacks via the searchU parameter in viewLogs.php, the id parameter in GetXmlHost.php, the chartId. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Centreon 3.4.6 including Centreon Web 2.8.23 is vulnerable to an authenticated user injecting a payload into the username or command description, resulting in stored XSS. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
There is Remote Code Execution in Centreon 3.4.6 including Centreon Web 2.8.23 via the RPN value in the Virtual Metric form in centreonGraph.class.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.