What’s Vulnerable › Products
Centreon vulnerabilities
56 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 25 published in the last 12 months.
Check whether your Centreon version is affected
Latest Centreon vulnerabilities
- CVE-2026-2751 — Blind SQL Injection (CVSS 9.8)
- CVE-2025-12513 — A user with elevated privileges can inject XSS in the Hosts configuration parameters page (CVSS 4.8)
- CVE-2025-13056 — A user with elevated privileges can inject XSS in the Administration ACL Menus configuration page (CVSS 4.8)
- CVE-2025-12519 — Information disclosure on Administration parameters API endpoint (CVSS 5.3)
- CVE-2025-5965 — RCE via the backup feature available only to user with high privilege (CVSS 7.2)
- CVE-2025-54890 — A user with elevated privileges can inject XSS in the Hostgroups configuration page (CVSS 4.8)
- CVE-2025-10023 — A user with elevated privileges can inject XSS in the Services Meta-services configuration page (CVSS 4.8)
- CVE-2025-8459 — A user with low privileges can inject XSS in the Monitoring Recurrent downtimes page (CVSS 5.4)
- CVE-2025-8430 — A user with elevated privileges can inject XSS in the Commands Connectors configuration configuration page (CVSS 4.8)
- CVE-2025-8429 — A user with elevated privileges can inject XSS in the ACL Action access configuration page (CVSS 4.8)
- CVE-2025-54893 — A user with elevated privileges can inject XSS in the Hosts templates configuration page (CVSS 4.8)
- CVE-2025-8428 — XSS found in the HTTP loader widget (CVSS 5.4)
- CVE-2025-5946 — RCE via the poller reload feature available only to user with high privilege (CVSS 7.2)
- CVE-2025-54892 — A user with elevated privileges can inject XSS in the SNMP traps group configuration page (CVSS 4.8)
- CVE-2025-54891 — A user with elevated privileges can inject XSS in the ACL Resource Access configuration page (CVSS 4.8)
- CVE-2025-54889 — A user with elevated privileges can inject XSS in the SNMP traps manufacturer configuration page (CVSS 4.8)
- CVE-2025-6791 — Second order SQL injection available to user with low privilege (CVSS 8.8)
- CVE-2025-4650 — User with high privileges is able to introduce a SQLi using the Meta Service indicator page (CVSS 7.2)
- CVE-2025-4649 — ACL are not correctly taken into account in the display of the "event logs" page. This page requiring, high privileges, will display all available logs. (CVSS 4.9)
- CVE-2025-4648 — A user with elevated privileges can inject XSS by altering the content of a SVG media during the submit request. (CVSS 5.9)
- CVE-2025-4647 — A user with elevated privileges can bypass sanitization measures by replacing the content of an existing SVG (CVSS 4.8)
- CVE-2025-4646 — A high privilege user is able to create and use a valid admin API token in centreon-web (CVSS 7.2)
- CVE-2025-3872 — Privilege escalation by altering payload in contact form (CVSS 7.2)
- CVE-2024-55573 — (CVSS 7.2)
- CVE-2024-53923 — (CVSS 7.2)