centreon vulnerabilities

Recent CVEs affecting centreon products. 36 tracked.

centreon has 36 tracked vulnerabilities, 6 critical. A fixed release or vendor patch exists for 34. Most recent: 2026-02-27. Highest priority: CVE-2025-15029 (score 66/100).

CVE-2025-12514 HIGH 7.2 UPGRADE Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon
CVE-2025-8460 MEDIUM 6.8 UPGRADE Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in C
CVE-2025-54890 MEDIUM 6.8 UPGRADE Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in C
CVE-2025-5946 HIGH 7.2 UPGRADE Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Ce
CVE-2025-8459 HIGH 7.7 UPGRADE Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in C
CVE-2025-54889 MEDIUM 6.8 UPGRADE Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in C
CVE-2025-54891 MEDIUM 6.8 UPGRADE Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in C
CVE-2025-54892 MEDIUM 6.8 UPGRADE Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in C
CVE-2025-8428 MEDIUM 6.8 UPGRADE Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in C
CVE-2025-8430 MEDIUM 6.8 UPGRADE Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in C
CVE-2025-54893 MEDIUM 6.8 UPGRADE Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in C
CVE-2025-8429 MEDIUM 6.8 UPGRADE Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in C
CVE-2025-10023 MEDIUM 6.2 UPGRADE Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in C
CVE-2025-5965 HIGH 7.2 UPGRADE In the backup parameters, a user with high privilege is able to concatenate custom instructions to the backup
CVE-2025-15029 CRITICAL 9.8 UPGRADE Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon
CVE-2025-15026 CRITICAL 9.8 UPGRADE Missing Authentication for Critical Function vulnerability in Centreon Infra Monitoring centreon-awie (Awie im
CVE-2026-2751 HIGH 8.3 UPGRADE Blind SQL Injection via unsanitized array keys in Service Dependencies deletion
CVE-2026-2750 CRITICAL 9.1 UPGRADE Improper Input Validation vulnerability in Centreon Centreon Open Tickets on Central Server on Linux (Centreon
CVE-2026-2749 CRITICAL 9.9 UPGRADE Vulnerability in Centreon Centreon Open Tickets on Central Server on Linux (Centroen Open Ticket modules).This
CVE-2025-6791 HIGH 8.8 UPGRADE In the monitoring event logs page, it is possible to alter the http request to insert a reflect payload in the
CVE-2025-4650 HIGH 7.2 UPGRADE User with high privileges is able to introduce a SQLi using the Meta Service indicator page
CVE-2025-4649 MEDIUM 4.9 UPGRADE Improper Handling of Exceptional Conditions vulnerability in Centreon web allows Privilege Escalation. ACL
CVE-2025-4648 HIGH 8.4 UPGRADE The content of a SVG file, received as input in Centreon web, was not properly checked
CVE-2025-4647 HIGH 8.4 UPGRADE Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in C
CVE-2025-4646 HIGH 7.2 UPGRADE Incorrect Authorization vulnerability in Centreon web (API Token creation form modules) allows Privilege Escal
CVE-2025-3872 HIGH 7.2 UPGRADE Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon
CVE-2025-13056 MEDIUM 6.8 UPGRADE Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in C
CVE-2025-12519 MEDIUM 5.3 UPGRADE Missing Authorization vulnerability in Centreon Infra Monitoring (Administration parameters API endpoint modul
CVE-2025-12513 MEDIUM 6.8 UPGRADE Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in C
CVE-2025-12511 MEDIUM 6.8 UPGRADE Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in C
CVE-2024-5725 HIGH 8.8 UPGRADE Centreon initCurveList SQL Injection Remote Code Execution Vulnerability
CVE-2024-5723 HIGH 8.8 UPGRADE Centreon updateServiceHost SQL Injection Remote Code Execution Vulnerability
CVE-2024-55573 CRITICAL 9.1 UPGRADE An issue was discovered in Centreon centreon-web 24.10.x before 24.10.3, 24.04.x before 24.04.9, 23.10.x befor
CVE-2024-53923 CRITICAL 9.1 UPGRADE An issue was discovered in Centreon Web 24.10.x before 24.10.3, 24.04.x before 24.04.9, 23.10.x before 23.10.1
CVE-2024-39843 MEDIUM 6.7 DOWNGRADE A SQL injection vulnerability in Centreon 24.04.2 allows a remote high-privileged attacker to execute arbitrar
CVE-2024-39842 HIGH 7.2 DOWNGRADE A SQL injection vulnerability in Centreon 24.04.2 allows a remote high-privileged attacker to execute arbitrar

FAQ

How do I fix centreon vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is centreon being exploited right now?

None of the tracked centreon CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which centreon CVE should I patch first?

CVE-2025-15029 currently ranks highest (66/100): Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon.

Products

RSS feed for centreon · ← Back to latest CVEs