Centreon Infra Monitoring
21 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-14453 | 24.10.0 – < 24.10.14 ; 25.10.0 – < 25.10.9 | A user with low privileges can inject SSTI templates that can lead to RCE in open-tickets | CRITICAL 9.6 | 0.8 % | ||
| CVE-2025-15029 | 25.10.0 – < 25.10.2 ; 24.10.0 – < 24.10.3 ; 24.04.0 – < 24.04.3 | An unauthenticated user is able to introduce SQL Injection using the Awie export module | CRITICAL 9.8 | 13 % | ||
| CVE-2025-15026 | 25.10.0 – < 25.10.2 ; 24.10.0 – < 24.10.3 ; 24.04.0 – < 24.04.3 | Unauthenticated configuration import allows administrative account creation using AWIE component | CRITICAL 9.8 | 0.4 % | ||
| CVE-2025-12511 | 25.10.0 – < 25.10.1 ; 24.10.0 – < 24.10.4 ; 24.04.0 – < 24.04.8 | A user with elevated privileges can inject XSS in the DSM Administration’s Extensions configuration page | MEDIUM 6.8 | 0.2 % | ||
| CVE-2025-12513 | 25.10.0 – < 25.10.2 ; 24.10.0 – < 24.10.15 ; 24.04.0 – < 24.04.19 | A user with elevated privileges can inject XSS in the Hosts configuration parameters page | MEDIUM 6.8 | 0.2 % | ||
| CVE-2025-12519 | 25.10.0 – < 25.10.2 ; 24.10.0 – < 24.10.15 ; 24.04.0 – < 24.04.19 | Information disclosure on Administration parameters API endpoint | MEDIUM 5.3 | 0.2 % | ||
| CVE-2025-13056 | 25.10.0 – < 25.10.2 ; 24.10.0 – < 24.10.15 ; 24.04.0 – < 24.04.19 | A user with elevated privileges can inject XSS in the Administration ACL Menus configuration page | MEDIUM 6.8 | 0.2 % | ||
| CVE-2025-5965 | 25.10.0 – < 25.10.2 ; 24.10.0 – < 24.10.15 ; 24.04.0 – < 24.04.19 | RCE via the backup feature available only to user with high privilege | HIGH 7.2 | 28 % | ||
| CVE-2025-54890 | 24.10.0 – < 24.10.15 ; 24.04.0 – < 24.04.19 ; 23.10.0 – < 23.10.29 | A user with elevated privileges can inject XSS in the Hostgroups configuration page | MEDIUM 6.8 | 0.2 % | ||
| CVE-2025-8460 | 24.10.0 – < 24.10.5 ; 24.04.0 – < 24.04.5 ; 23.10.0 – < 23.10.4 | A user with elevated privileges can inject XSS in the Notification rules configuration page | MEDIUM 6.8 | 0.2 % | ||
| CVE-2025-10023 | 24.10.0 – < 24.10.9 ; 24.04.0 – < 24.04.16 ; 23.10.0 – < 23.10.26 | A user with elevated privileges can inject XSS in the Services Meta-services configuration page | MEDIUM 6.2 | 0.2 % | ||
| CVE-2025-8432 | 24.10.0 – < 24.10.6 ; 24.04.0 – < 24.04.9 ; 23.10.0 – < 23.10.15 | CentreonBI user account on the MBI server can execute commands as root by modifying script runned by the CRON | HIGH 8.4 | 0.4 % | ||
| CVE-2025-8459 | 24.10.0 – < 24.10.13 ; 24.04.0 – < 24.04.18 ; 23.10.0 – < 23.10.28 | A user with low privileges can inject XSS in the Monitoring Recurrent downtimes page | HIGH 7.7 | 0.2 % | ||
| CVE-2025-8430 | 24.10.0 – < 24.10.13 ; 24.04.0 – < 24.04.18 ; 23.10.0 – < 23.10.28 | A user with elevated privileges can inject XSS in the Commands Connectors configuration configuration page | MEDIUM 6.8 | 0.2 % | ||
| CVE-2025-8429 | 24.10.0 – < 24.10.13 ; 24.04.0 – < 24.04.18 ; 23.10.0 – < 23.10.28 | A user with elevated privileges can inject XSS in the ACL Action access configuration page | MEDIUM 6.8 | 0.2 % | ||
| CVE-2025-54893 | 24.10.0 – < 24.10.13 ; 24.04.0 – < 24.04.18 ; 23.10.0 – < 23.10.28 | A user with elevated privileges can inject XSS in the Hosts templates configuration page | MEDIUM 6.8 | 0.2 % | ||
| CVE-2025-54891 | 24.10.0 – < 24.10.13 ; 24.04.0 – < 24.04.18 ; 23.10.0 – < 23.10.28 | A user with elevated privileges can inject XSS in the ACL Resource Access configuration page | MEDIUM 6.8 | 0.3 % | ||
| CVE-2025-54892 | 24.10.0 – < 24.10.13 ; 24.04.0 – < 24.04.18 ; 23.10.0 – < 23.10.28 | A user with elevated privileges can inject XSS in the SNMP traps group configuration page | MEDIUM 6.8 | 0.3 % | ||
| CVE-2025-54889 | 24.10.0 – < 24.10.13 ; 24.04.0 – < 24.04.18 ; 23.10.0 – < 23.10.28 | A user with elevated privileges can inject XSS in the SNMP traps manufacturer configuration page | MEDIUM 6.8 | 0.3 % | ||
| CVE-2025-5946 | 24.10.0 – < 24.10.13 ; 24.04.0 – < 24.04.18 ; 23.10.0 – < 23.10.28 | RCE via the poller reload feature available only to user with high privilege | HIGH 7.2 | 14 % | ||
| CVE-2025-8428 | 24.10.0 – < 24.10.13 ; 24.04.0 – < 24.04.18 ; 23.10.0 – < 23.10.28 | XSS found in the HTTP loader widget | MEDIUM 6.8 | 0.2 % |