CE
Product
Centreon
76
CVEs
0
On KEV
9.8
Max CVSS
3
New 30D
Severity mix
Critical 10High 42Medium 18Low 0
Watch
Add Centreon to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-39843 | 6.7 | Sep 23 | A SQL injection vulnerability in Centreon 24.04.2 allows a remote high-privileged attacker to execute arbitrary SQL command via create user form inputs Affected: 24.04.2 |
| CVE-2025-12523 New | 6.5 | Oct 29 | Broken Object Level Authorization in Users Configuration Endpoint (/centreon/api/latest/configuration/users) – Sensitive Information Disclosure Affected: 24.10 before centreon-web-25.10.6; 24.04 before centreon-web-24.10.21; 25.10.x before centreon-web-24.04.25 |
| CVE-2022-34872 | 6.5 | Aug 3 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Centreon Affected: 21.10-2 |
| CVE-2021-28055 | 6.5 | Apr 15 | An issue was discovered in Centreon-Web in Centreon Platform 20.10.0 Affected: 20.10.0 |
| CVE-2019-19486 | 6.5 | Mar 20 | Local File Inclusion in minPlayCommand.php in Centreon (19.04.4 and below) allows an attacker to traverse paths via a plugin test Affected: through 19.04.4 |
| CVE-2019-19484 | 6.1 | Mar 20 | Open redirect via parameter ‘p’ in login.php in Centreon (19.04.4 and below) allows an attacker to craft a payload and execute unintended behavior Affected: through 19.04.4 |
| CVE-2019-16195 | 6.1 | Nov 26 | Centreon before 2.8.30, 18.x before 18.10.8, and 19.x before 19.04.5 allows XSS via myAccount alias and name fields Affected: 2.8.0 before 2.8.30; 18.0.0 before 18.10.8; 19.0.0 before 19.04.5 |
| CVE-2018-19280 | 6.1 | Nov 14 | Centreon 3.4.x (fixed in Centreon 18.10.0) has XSS via the resource name or macro expression of a poller macro Affected: 3.4.0 through 3.4.9 |
| CVE-2025-13050 New | 5.4 | Oct 29 | Broken Function Level Authorization — `postcommand.php` allows execution of poller post-restart commands by non-admin users Affected: 25.10 before centreon-web-25.10.9; 24.10 before centreon-web-24.10.21; 24.04 before centreon-web-24.04.25 |
| CVE-2022-39988 | 5.4 | Oct 6 | A cross-site scripting (XSS) vulnerability in Centreon 22.04.0 allows attackers to execute arbitrary web script or HTML via a crafted payload injected into the Service>Templates… Affected: 22.04.0 |
| CVE-2022-40044 | 5.4 | Sep 26 | Centreon v20.10.18 was discovered to contain a cross-site scripting (XSS) vulnerability via the esc_name (Escalation Name) parameter at Configuration/Notifications/Escalations Affected: 20.10.18 |
| CVE-2022-36194 | 5.4 | Aug 29 | Centreon 22.04.0 is vulnerable to Cross Site Scripting (XSS) from the function Pollers > Broker Configuration by adding a crafted payload into the name parameter Affected: 22.04.0 |
| CVE-2021-28054 | 5.4 | Jul 16 | An issue was discovered in Centreon-Web in Centreon Platform 20.10.0 Affected: 20.10.0 |
| CVE-2021-27676 | 5.4 | May 26 | Centreon version 20.10.2 is affected by a cross-site scripting (XSS) vulnerability Affected: 20.10.2 |
| CVE-2018-19311 | 5.4 | Nov 16 | Centreon 3.4.x (fixed in Centreon 18.10.0) allows XSS via the Service field to the main.php?p=20201 URI, as demonstrated by the "Monitoring > Status Details > Services" screen Affected: 3.4.0 through 3.4.9 |
| CVE-2018-11588 | 5.4 | Jun 25 | Centreon 3.4.6 including Centreon Web 2.8.23 is vulnerable to an authenticated user injecting a payload into the username or command description, resulting in stored XSS Affected: 3.4.6 |
| CVE-2015-7672 | 5.4 | Sep 7 | Cross-site scripting (XSS) vulnerability in Centreon 2.6.1 (fixed in Centreon 18.10.0 and Centreon web 2.8.27) Affected: 2.6.1 |
| CVE-2020-10945 | 4.3 | May 27 | Centreon before 19.10.7 exposes Session IDs in server responses Affected: through 2.8.2; 18.10.0 before 18.10.11; 19.04.0 before 19.04.10; 19.10 before 19.10.7 |
Showing 18