https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-2751.htmlhttps://patchthecve.com/cve/CVE-2026-2751.htmlWed, 17 Jun 2026 10:31:39 +0000HIGH 8.3: Blind SQL Injection via unsanitized array keys in Service Dependencies deletion. Vulnerability in Centreon Centreon Web on Central Server on Linux (Service Dependencies modules) allows Blind SQL Injection.This issue affects Centreon Web on Central Server before 25.10.8, 24.10.20, 24.04.24.https://patchthecve.com/cve/CVE-2025-12513.htmlhttps://patchthecve.com/cve/CVE-2025-12513.htmlWed, 17 Jun 2026 08:32:30 +0000MEDIUM 6.8: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Hosts configuration form modules) allows Stored XSS to users with high privileges. This issue affects Infra Monitoring: from 25.10.0 before 25.10.2, from 24.10.0 bhttps://patchthecve.com/cve/CVE-2025-13056.htmlhttps://patchthecve.com/cve/CVE-2025-13056.htmlWed, 17 Jun 2026 08:33:25 +0000MEDIUM 6.8: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Administration ACL menu configuration modules) allows Stored XSS to users with high privileges. This issue affects Infra Monitoring: from 25.10.0 before 25.10.2,https://patchthecve.com/cve/CVE-2025-12519.htmlhttps://patchthecve.com/cve/CVE-2025-12519.htmlWed, 17 Jun 2026 08:32:31 +0000MEDIUM 5.3: Missing Authorization vulnerability in Centreon Infra Monitoring (Administration parameters API endpoint modules) allows Accessing Functionality Not Properly Constrained by ACLs, resulting in Information Disclosure like downtime or acknowledgement configurations. This issue affects Infra Monitoring:https://patchthecve.com/cve/CVE-2025-5965.htmlhttps://patchthecve.com/cve/CVE-2025-5965.htmlWed, 07 Oct 2026 11:10:00 +0000HIGH 7.2: In the backup parameters, a user with high privilege is able to concatenate custom instructions to the backup setup. Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Centreon Infra Monitoring (Backup configuration in the administration setuphttps://patchthecve.com/cve/CVE-2025-54890.htmlhttps://patchthecve.com/cve/CVE-2025-54890.htmlMon, 19 Oct 2026 22:10:00 +0000MEDIUM 6.8: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Hostgroup configuration page) allows Stored XSS by users with elevated privileges.This issue affects Infra Monitoring: from 24.10.0 before 24.10.15, from 24.04.0 https://patchthecve.com/cve/CVE-2025-10023.htmlhttps://patchthecve.com/cve/CVE-2025-10023.htmlThu, 08 Oct 2026 11:10:00 +0000MEDIUM 6.2: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Services Meta-services modules) allows Stored XSS by users with elevated privileges.This issue affects Infra Monitoring: from 24.10.0 before 24.10.9, from 24.04.0https://patchthecve.com/cve/CVE-2025-8459.htmlhttps://patchthecve.com/cve/CVE-2025-8459.htmlThu, 08 Oct 2026 12:10:00 +0000HIGH 7.7: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Monitoring recurrent downtime scheduler modules) allows Stored XSS.This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, https://patchthecve.com/cve/CVE-2025-8430.htmlhttps://patchthecve.com/cve/CVE-2025-8430.htmlThu, 08 Oct 2026 12:10:00 +0000MEDIUM 6.8: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Commands Connectors configuration modules) allows Stored XSS by users with elevated privileges. This issue affects Infra Monitoring: from 24.10.0 before 24.10.13https://patchthecve.com/cve/CVE-2025-8429.htmlhttps://patchthecve.com/cve/CVE-2025-8429.htmlThu, 08 Oct 2026 11:10:00 +0000MEDIUM 6.8: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (ACL Action access configuration modules) allows Stored XSS by users with elevated privileges. This issue affects Infra Monitoring: from 24.10.0 before 24.10.13,https://patchthecve.com/cve/CVE-2025-54893.htmlhttps://patchthecve.com/cve/CVE-2025-54893.htmlThu, 08 Oct 2026 11:10:00 +0000MEDIUM 6.8: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Hosts templates configuration modules) allows Stored XSS by users with elevated privileges. This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, fhttps://patchthecve.com/cve/CVE-2025-8428.htmlhttps://patchthecve.com/cve/CVE-2025-8428.htmlThu, 08 Oct 2026 12:10:00 +0000MEDIUM 6.8: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (HTTP Loader widget modules) allows Stored XSS.This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 2https://patchthecve.com/cve/CVE-2025-5946.htmlhttps://patchthecve.com/cve/CVE-2025-5946.htmlThu, 08 Oct 2026 12:10:00 +0000HIGH 7.2: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Centreon Infra Monitoring (Poller reload setup in the configuration modules) allows OS Command Injection. On the poller parameters page, a user with high privilege is able to concatenate custohttps://patchthecve.com/cve/CVE-2025-54892.htmlhttps://patchthecve.com/cve/CVE-2025-54892.htmlThu, 08 Oct 2026 12:10:00 +0000MEDIUM 6.8: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (SNMP traps group configuration modules) allows Stored XSS by users with elevated privileges. This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, fhttps://patchthecve.com/cve/CVE-2025-54891.htmlhttps://patchthecve.com/cve/CVE-2025-54891.htmlThu, 08 Oct 2026 12:10:00 +0000MEDIUM 6.8: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (ACL Resource access configuration modules) allows Stored XSS by users with elevated privileges. This issue affects Infra Monitoring: from 24.10.0 before 24.10.13https://patchthecve.com/cve/CVE-2025-54889.htmlhttps://patchthecve.com/cve/CVE-2025-54889.htmlThu, 08 Oct 2026 12:10:00 +0000MEDIUM 6.8: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (SNMP traps manufacturer configuration modules) allows Stored XSS by users with elevated privileges. This issue affects Infra Monitoring: from 24.10.0 before 24.10.https://patchthecve.com/cve/CVE-2025-6791.htmlhttps://patchthecve.com/cve/CVE-2025-6791.htmlWed, 17 Jun 2026 10:02:34 +0000HIGH 8.8: In the monitoring event logs page, it is possible to alter the http request to insert a reflect payload in the DB. Caused by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon web (Monitoring event logs modules) allows SQL Injection.Thishttps://patchthecve.com/cve/CVE-2025-4650.htmlhttps://patchthecve.com/cve/CVE-2025-4650.htmlWed, 17 Jun 2026 09:33:40 +0000HIGH 7.2: User with high privileges is able to introduce a SQLi using the Meta Service indicator page. Caused by an Improper Neutralization of Special Elements used in an SQL Command.This issue affects web: from 24.10.0 before 24.10.9, from 24.04.0 before 24.04.16, from 23.10.0 before 23.10.26.https://patchthecve.com/cve/CVE-2025-4649.htmlhttps://patchthecve.com/cve/CVE-2025-4649.htmlWed, 17 Jun 2026 09:33:40 +0000MEDIUM 4.9: Improper Handling of Exceptional Conditions vulnerability in Centreon web allows Privilege Escalation. ACL are not correctly taken into account in the display of the "event logs" page. This page requiring, high privileges, will display all available logs. This issue affects web: from 24.10.3 befohttps://patchthecve.com/cve/CVE-2025-4648.htmlhttps://patchthecve.com/cve/CVE-2025-4648.htmlWed, 17 Jun 2026 09:33:40 +0000HIGH 8.4: The content of a SVG file, received as input in Centreon web, was not properly checked. Allows Reflected XSS. A user with elevated privileges can inject JS script by altering the content of a SVG media, during the submit request. This issue affects web: from 24.10.0 before 24.10.5, from 24.04.0 behttps://patchthecve.com/cve/CVE-2025-4647.htmlhttps://patchthecve.com/cve/CVE-2025-4647.htmlWed, 17 Jun 2026 09:33:40 +0000HIGH 8.4: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon web allows Reflected XSS. A user with elevated privileges can bypass sanitization measures by replacing the content of an existing SVG. This issue affects web: from 24.10.0 before https://patchthecve.com/cve/CVE-2025-4646.htmlhttps://patchthecve.com/cve/CVE-2025-4646.htmlWed, 17 Jun 2026 09:33:40 +0000HIGH 7.2: Incorrect Authorization vulnerability in Centreon web (API Token creation form modules) allows Privilege Escalation.This issue affects web: from 24.04.0 before 24.04.10, from 24.10.0 before 24.10.4.https://patchthecve.com/cve/CVE-2025-3872.htmlhttps://patchthecve.com/cve/CVE-2025-3872.htmlWed, 17 Jun 2026 09:20:50 +0000HIGH 7.2: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon centreon-web (User configuration form modules) allows SQL Injection. A user with high privileges is able to become administrator by intercepting the contact form request and altering its https://patchthecve.com/cve/CVE-2024-55573.htmlhttps://patchthecve.com/cve/CVE-2024-55573.htmlWed, 17 Jun 2026 08:11:15 +0000CRITICAL 9.1: An issue was discovered in Centreon centreon-web 24.10.x before 24.10.3, 24.04.x before 24.04.9, 23.10.x before 23.10.19, 23.04.x before 23.04.24. A user with high privileges is able to inject SQL into the form used to create virtual metrics.https://patchthecve.com/cve/CVE-2024-53923.htmlhttps://patchthecve.com/cve/CVE-2024-53923.htmlWed, 17 Jun 2026 08:09:30 +0000CRITICAL 9.1: An issue was discovered in Centreon Web 24.10.x before 24.10.3, 24.04.x before 24.04.9, 23.10.x before 23.10.19, 23.04.x before 23.04.24. A user with high privileges is able to achieve SQL injection in the form to upload media.https://patchthecve.com/cve/CVE-2024-5725.htmlhttps://patchthecve.com/cve/CVE-2024-5725.htmlWed, 17 Jun 2026 08:16:31 +0000HIGH 8.8: Centreon initCurveList SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the initCurveList function.https://patchthecve.com/cve/CVE-2024-5723.htmlhttps://patchthecve.com/cve/CVE-2024-5723.htmlWed, 17 Jun 2026 08:16:30 +0000HIGH 8.8: Centreon updateServiceHost SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the updateServiceHost fhttps://patchthecve.com/cve/CVE-2023-51633.htmlhttps://patchthecve.com/cve/CVE-2023-51633.htmlWed, 17 Jun 2026 06:41:22 +0000CRITICAL 9.6: Centreon sysName Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. User interaction is required to exploit this vulnerability. The specific flaw exists within the processing of the syhttps://patchthecve.com/cve/CVE-2024-23119.htmlhttps://patchthecve.com/cve/CVE-2024-23119.htmlWed, 17 Jun 2026 07:12:04 +0000HIGH 8.8: Centreon insertGraphTemplate SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the insertGraphTemplahttps://patchthecve.com/cve/CVE-2024-23118.htmlhttps://patchthecve.com/cve/CVE-2024-23118.htmlWed, 17 Jun 2026 07:12:04 +0000HIGH 7.2: Centreon updateContactHostCommands SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the updateContahttps://patchthecve.com/cve/CVE-2024-23117.htmlhttps://patchthecve.com/cve/CVE-2024-23117.htmlWed, 17 Jun 2026 07:12:04 +0000HIGH 7.2: Centreon updateContactServiceCommands SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the updateCohttps://patchthecve.com/cve/CVE-2024-23116.htmlhttps://patchthecve.com/cve/CVE-2024-23116.htmlWed, 17 Jun 2026 07:12:03 +0000HIGH 7.2: Centreon updateLCARelation SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the updateLCARelation fhttps://patchthecve.com/cve/CVE-2024-23115.htmlhttps://patchthecve.com/cve/CVE-2024-23115.htmlWed, 17 Jun 2026 07:12:03 +0000HIGH 7.2: Centreon updateGroups SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the updateGroups function. Thttps://patchthecve.com/cve/CVE-2024-0637.htmlhttps://patchthecve.com/cve/CVE-2024-0637.htmlWed, 17 Jun 2026 06:53:56 +0000HIGH 8.8: Centreon updateDirectory SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the updateDirectory funct