Centreon vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-14453 This vulnerability is a critical Server-Side Template Injection (SSTI) in Centreon's centreon-open-tickets module that leads to Remote Code Execution.Critical 9.6 · Jul 13, 2026
• CVE-2026-2750 Improper Input Validation vulnerability in Centreon Centreon Open Tickets on Central Server on Linux (Centreon Open Tickets modules).This issue affects CentreonCritical 9.1 · Feb 27, 2026
• CVE-2026-2749 Vulnerability in Centreon Centreon Open Tickets on Central Server on Linux (Centroen Open Ticket modules).This issue affects Centreon Open Tickets on Central SeCritical 9.9 · Feb 27, 2026
• CVE-2026-2751 Blind SQL Injection via unsanitized array keys in Service Dependencies deletion.High 8.3 · Feb 27, 2026
• CVE-2025-15029 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon Infra Monitoring (Awie export modules) allows SQLCritical 9.8 · Jan 5, 2026
• CVE-2025-15026 Missing Authentication for Critical Function vulnerability in Centreon Infra Monitoring centreon-awie (Awie import module) allows Accessing Functionality Not PrCritical 9.8 · Jan 5, 2026
• CVE-2025-5965 In the backup parameters, a user with high privilege is able to concatenate custom instructions to the backup setup.High 7.2 · Jan 5, 2026
• CVE-2025-12514 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon Infra Monitoring - Open-tickets (Notification rulHigh 7.2 · Dec 22, 2025
• CVE-2025-8432 Incorrect Default Permissions vulnerability in Centreon Infra Monitoring (MBI modules) allows Embedding Scripts within Scripts by CentreonBI user account on theHigh 8.4 · Oct 27, 2025
• CVE-2025-8459 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Monitoring recurrent dowHigh 7.7 · Oct 14, 2025
• CVE-2025-5946 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Centreon Infra Monitoring (Poller reload setup in thHigh 7.2 · Oct 14, 2025
• CVE-2025-6791 In the monitoring event logs page, it is possible to alter the http request to insert a reflect payload in the DB.High 8.8 · Aug 22, 2025
• CVE-2025-4650 User with high privileges is able to introduce a SQLi using the Meta Service indicator page.High 7.2 · Aug 22, 2025
• CVE-2025-4648 The content of a SVG file, received as input in Centreon web, was not properly checked.High 8.4 · May 13, 2025
• CVE-2025-4647 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon web allows Reflected XSS.High 8.4 · May 13, 2025
• CVE-2025-4646 Incorrect Authorization vulnerability in Centreon web (API Token creation form modules) allows Privilege Escalation.This issue affects web: from 24.04.0 before High 7.2 · May 13, 2025
• CVE-2025-3872 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon centreon-web (User configuration form modules) alHigh 7.2 · Apr 24, 2025
• CVE-2025-3767 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon BAM (Boolean KPi Listing modules) allows SQL InjeHigh 7.2 · Apr 22, 2025
• CVE-2024-55573 An issue was discovered in Centreon centreon-web 24.10.x before 24.10.3, 24.04.x before 24.04.9, 23.10.x before 23.10.19, 23.04.x before 23.04.24.Critical 9.1 · Jan 23, 2025
• CVE-2024-53923 An issue was discovered in Centreon Web 24.10.x before 24.10.3, 24.04.x before 24.04.9, 23.10.x before 23.10.19, 23.04.x before 23.04.24.Critical 9.1 · Jan 23, 2025
• CVE-2024-45756 An issue was discovered in Centreon centreon-open-tickets 24.10.x before 24.10.0, 24.04.x before 24.04.2, 23.10.x before 23.10.1, 23.04.x before 23.04.3, and 22High 7.2 · Nov 25, 2024
• CVE-2024-45755 An issue was discovered in Centreon centreon-dsm-server 24.10.x before 24.10.0, 24.04.x before 24.04.3, 23.10.x before 23.10.1, 23.04.x before 23.04.3, and 22.1High 7.2 · Nov 25, 2024
• CVE-2024-45754 An issue was discovered in the centreon-bi-server component in Centreon BI Server 24.04.x before 24.04.3, 23.10.x before 23.10.8, 23.04.x before 23.04.11, and 2High 7.2 · Oct 11, 2024
• CVE-2024-39842 A SQL injection vulnerability in Centreon 24.04.2 allows a remote high-privileged attacker to execute arbitrary SQL command via user massive changes inputs.High 7.2 · Sep 23, 2024
• CVE-2024-39841 A SQL Injection vulnerability exists in the service configuration functionality in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before High 8.8 · Aug 23, 2024