High severity · published Aug 22, 2025
CVE-2025-4650
User with high privileges is able to introduce a SQLi using the Meta Service indicator page
7.2
CVSS
0.4%
EPSS
No
On KEV
Description
User with high privileges is able to introduce a SQLi using the Meta Service indicator page. Caused by an Improper Neutralization of Special Elements used in an SQL Command.This issue affects web: from 24.10.0 before 24.10.9, from 24.04.0 before 24.04.16, from 23.10.0 before 23.10.26.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
web · Centreon
24.10.0 before 24.10.9; 24.04.0 before 24.04.16; 23.10.0 before 23.10.26 · source: vendor
CW
Centreon Web · Centreon
23.10.0 before 23.10.26; 24.04.0 before 24.04.16; 24.10.0 before 24.10.9 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-4650
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-4650
Release Notes
https://github.com/centreon/centreon/releases
Vendor Advisory
https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-4650-centreon-web-all-versions-high-severity-4901
More from web
9.8
CVE-2026-2750
Command Injection via CLAPI generatetraps
8.8
CVE-2025-6791
Second order SQL injection available to user with low privilege
7.2
CVE-2025-4646
A high privilege user is able to create and use a valid admin API token in centreon-web
5.9
CVE-2025-4648
A user with elevated privileges can inject XSS by altering the content of a SVG media during the submit request.
4.9
CVE-2025-4649
ACL are not correctly taken into account in the display of the "event logs" page. This page requiring, high privileges, will display all available logs.