Centreon vulnerabilities
55 CVEs and advisories name Centreon as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-11587Authenticated SQL Injection via PHP Array Key in ACL Management (Resources & Actions) — Centreon 26.03.0
- CVE-2025-12523Broken Object Level Authorization in Users Configuration Endpoint (/centreon/api/latest/configuration/users) – Sensitive Information…
- CVE-2025-13050Broken Function Level Authorization — `postcommand.php` allows execution of poller post-restart commands by non-admin users
- CVE-2026-14453A user with low privileges can inject SSTI templates that can lead to RCE in open-tickets
- CVE-2026-2749Path traversal in Centreon Open Tickets
- CVE-2026-2750Command Injection via CLAPI generatetraps
- CVE-2026-2751Blind SQL Injection
- CVE-2025-15029An unauthenticated user is able to introduce SQL Injection using the Awie export module
- CVE-2025-15026Unauthenticated configuration import allows administrative account creation using AWIE component
- CVE-2025-12511A user with elevated privileges can inject XSS in the DSM Administration’s Extensions configuration page
- CVE-2025-12513A user with elevated privileges can inject XSS in the Hosts configuration parameters page
- CVE-2025-12519Information disclosure on Administration parameters API endpoint
- CVE-2025-13056A user with elevated privileges can inject XSS in the Administration ACL Menus configuration page
- CVE-2025-5965RCE via the backup feature available only to user with high privilege
- CVE-2025-54890A user with elevated privileges can inject XSS in the Hostgroups configuration page
- CVE-2025-12514A user with elevated privileges is able to introduce a SQL Injection using the Open-tickets Notification rules configuration parameters
- CVE-2025-8460A user with elevated privileges can inject XSS in the Notification rules configuration page
- CVE-2025-10023A user with elevated privileges can inject XSS in the Services Meta-services configuration page
- CVE-2025-8432CentreonBI user account on the MBI server can execute commands as root by modifying script runned by the CRON
- CVE-2025-8459A user with low privileges can inject XSS in the Monitoring Recurrent downtimes page
- CVE-2025-8430A user with elevated privileges can inject XSS in the Commands Connectors configuration configuration page
- CVE-2025-8429A user with elevated privileges can inject XSS in the ACL Action access configuration page
- CVE-2025-54893A user with elevated privileges can inject XSS in the Hosts templates configuration page
- CVE-2025-54891A user with elevated privileges can inject XSS in the ACL Resource Access configuration page
- CVE-2025-54892A user with elevated privileges can inject XSS in the SNMP traps group configuration page
- CVE-2025-54889A user with elevated privileges can inject XSS in the SNMP traps manufacturer configuration page
- CVE-2025-5946RCE via the poller reload feature available only to user with high privilege
- CVE-2025-8428XSS found in the HTTP loader widget
- CVE-2025-6791Second order SQL injection available to user with low privilege
- CVE-2025-4650User with high privileges is able to introduce a SQLi using the Meta Service indicator page