centreon web vulnerabilities and fixes

Recent CVEs affecting centreon web, with upgrade or downgrade steps. 34 tracked.

Also searched as: centreonweb.

centreon web has 34 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 34. Most recent: 2026-02-27. Highest priority: CVE-2024-5725 (score 56/100).

• CVE-2025-54890 MEDIUM 6.8 UPGRADE Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in C
• CVE-2025-5946 HIGH 7.2 UPGRADE Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Ce
• CVE-2025-8459 HIGH 7.7 UPGRADE Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in C
• CVE-2025-54889 MEDIUM 6.8 UPGRADE Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in C
• CVE-2025-54891 MEDIUM 6.8 UPGRADE Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in C
• CVE-2025-54892 MEDIUM 6.8 UPGRADE Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in C
• CVE-2025-8428 MEDIUM 6.8 UPGRADE Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in C
• CVE-2025-8430 MEDIUM 6.8 UPGRADE Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in C
• CVE-2025-54893 MEDIUM 6.8 UPGRADE Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in C
• CVE-2025-8429 MEDIUM 6.8 UPGRADE Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in C
• CVE-2025-10023 MEDIUM 6.2 UPGRADE Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in C
• CVE-2025-5965 HIGH 7.2 UPGRADE In the backup parameters, a user with high privilege is able to concatenate custom instructions to the backup
• CVE-2026-2751 HIGH 8.3 UPGRADE Blind SQL Injection via unsanitized array keys in Service Dependencies deletion
• CVE-2025-6791 HIGH 8.8 UPGRADE In the monitoring event logs page, it is possible to alter the http request to insert a reflect payload in the
• CVE-2025-4650 HIGH 7.2 UPGRADE User with high privileges is able to introduce a SQLi using the Meta Service indicator page
• CVE-2025-4649 MEDIUM 4.9 UPGRADE Improper Handling of Exceptional Conditions vulnerability in Centreon web allows Privilege Escalation. ACL
• CVE-2025-4648 HIGH 8.4 UPGRADE The content of a SVG file, received as input in Centreon web, was not properly checked
• CVE-2025-4647 HIGH 8.4 UPGRADE Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in C
• CVE-2025-4646 HIGH 7.2 UPGRADE Incorrect Authorization vulnerability in Centreon web (API Token creation form modules) allows Privilege Escal
• CVE-2025-3872 HIGH 7.2 UPGRADE Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon
• CVE-2025-13056 MEDIUM 6.8 UPGRADE Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in C
• CVE-2025-12519 MEDIUM 5.3 UPGRADE Missing Authorization vulnerability in Centreon Infra Monitoring (Administration parameters API endpoint modul
• CVE-2025-12513 MEDIUM 6.8 UPGRADE Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in C
• CVE-2024-5725 HIGH 8.8 UPGRADE Centreon initCurveList SQL Injection Remote Code Execution Vulnerability
• CVE-2024-5723 HIGH 8.8 UPGRADE Centreon updateServiceHost SQL Injection Remote Code Execution Vulnerability
• CVE-2024-55573 CRITICAL 9.1 UPGRADE An issue was discovered in Centreon centreon-web 24.10.x before 24.10.3, 24.04.x before 24.04.9, 23.10.x befor
• CVE-2024-53923 CRITICAL 9.1 UPGRADE An issue was discovered in Centreon Web 24.10.x before 24.10.3, 24.04.x before 24.04.9, 23.10.x before 23.10.1
• CVE-2024-23119 HIGH 8.8 UPGRADE Centreon insertGraphTemplate SQL Injection Remote Code Execution Vulnerability
• CVE-2024-23118 HIGH 7.2 UPGRADE Centreon updateContactHostCommands SQL Injection Remote Code Execution Vulnerability
• CVE-2024-23117 HIGH 7.2 UPGRADE Centreon updateContactServiceCommands SQL Injection Remote Code Execution Vulnerability
• CVE-2024-23116 HIGH 7.2 UPGRADE Centreon updateLCARelation SQL Injection Remote Code Execution Vulnerability
• CVE-2024-23115 HIGH 7.2 UPGRADE Centreon updateGroups SQL Injection Remote Code Execution Vulnerability
• CVE-2024-0637 HIGH 8.8 UPGRADE Centreon updateDirectory SQL Injection Remote Code Execution Vulnerability
• CVE-2023-51633 CRITICAL 9.6 UPGRADE Centreon sysName Cross-Site Scripting Remote Code Execution Vulnerability

FAQ

How do I fix centreon web vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is centreon web being exploited right now?

None of the tracked centreon web CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which centreon web CVE should I patch first?

CVE-2024-5725 currently ranks highest (56/100): Centreon initCurveList SQL Injection Remote Code Execution Vulnerability.

RSS feed for centreon web · ← Back to latest CVEs