# cve.now: Centreon

The newest entries naming Centreon as an affected vendor (up to 200), of 55 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-11587](https://cve.now/CVE-2026-11587.md): Authenticated SQL Injection via PHP Array Key in ACL Management (Resources & Actions) — Centreon 26.03.0 (CVSS 7.2)
- [CVE-2025-12523](https://cve.now/CVE-2025-12523.md): Broken Object Level Authorization in Users Configuration Endpoint (/centreon/api/latest/configuration/users) – Sensitive Information… (CVSS 6.5)
- [CVE-2025-13050](https://cve.now/CVE-2025-13050.md): Broken Function Level Authorization — \`postcommand.php\` allows execution of poller post-restart commands by non-admin users (CVSS 5.4)
- [CVE-2026-14453](https://cve.now/CVE-2026-14453.md): A user with low privileges can inject SSTI templates that can lead to RCE in open-tickets (CVSS 9.6)
- [CVE-2026-2749](https://cve.now/CVE-2026-2749.md): Path traversal in Centreon Open Tickets (CVSS 9.9)
- [CVE-2026-2750](https://cve.now/CVE-2026-2750.md): Command Injection via CLAPI generatetraps (CVSS 9.1)
- [CVE-2026-2751](https://cve.now/CVE-2026-2751.md): Blind SQL Injection (CVSS 8.3)
- [CVE-2025-15029](https://cve.now/CVE-2025-15029.md): An unauthenticated user is able to introduce SQL Injection using the Awie export module (CVSS 9.8)
- [CVE-2025-15026](https://cve.now/CVE-2025-15026.md): Unauthenticated configuration import allows administrative account creation using AWIE component (CVSS 9.8)
- [CVE-2025-12511](https://cve.now/CVE-2025-12511.md): A user with elevated privileges can inject XSS in the DSM Administration’s Extensions configuration page (CVSS 6.8)
- [CVE-2025-12513](https://cve.now/CVE-2025-12513.md): A user with elevated privileges can inject XSS in the Hosts configuration parameters page (CVSS 6.8)
- [CVE-2025-12519](https://cve.now/CVE-2025-12519.md): Information disclosure on Administration parameters API endpoint (CVSS 5.3)
- [CVE-2025-13056](https://cve.now/CVE-2025-13056.md): A user with elevated privileges can inject XSS in the Administration ACL Menus configuration page (CVSS 6.8)
- [CVE-2025-5965](https://cve.now/CVE-2025-5965.md): RCE via the backup feature available only to user with high privilege (CVSS 7.2)
- [CVE-2025-54890](https://cve.now/CVE-2025-54890.md): A user with elevated privileges can inject XSS in the Hostgroups configuration page (CVSS 6.8)
- [CVE-2025-12514](https://cve.now/CVE-2025-12514.md): A user with elevated privileges is able to introduce a SQL Injection using the Open-tickets Notification rules configuration parameters (CVSS 7.2)
- [CVE-2025-8460](https://cve.now/CVE-2025-8460.md): A user with elevated privileges can inject XSS in the Notification rules configuration page (CVSS 6.8)
- [CVE-2025-10023](https://cve.now/CVE-2025-10023.md): A user with elevated privileges can inject XSS in the Services Meta-services configuration page (CVSS 6.2)
- [CVE-2025-8432](https://cve.now/CVE-2025-8432.md): CentreonBI user account on the MBI server can execute commands as root by modifying script runned by the CRON (CVSS 8.4)
- [CVE-2025-8459](https://cve.now/CVE-2025-8459.md): A user with low privileges can inject XSS in the Monitoring Recurrent downtimes page (CVSS 7.7)
- [CVE-2025-8430](https://cve.now/CVE-2025-8430.md): A user with elevated privileges can inject XSS in the Commands Connectors configuration configuration page (CVSS 6.8)
- [CVE-2025-8429](https://cve.now/CVE-2025-8429.md): A user with elevated privileges can inject XSS in the ACL Action access configuration page (CVSS 6.8)
- [CVE-2025-54893](https://cve.now/CVE-2025-54893.md): A user with elevated privileges can inject XSS in the Hosts templates configuration page (CVSS 6.8)
- [CVE-2025-54891](https://cve.now/CVE-2025-54891.md): A user with elevated privileges can inject XSS in the ACL Resource Access configuration page (CVSS 6.8)
- [CVE-2025-54892](https://cve.now/CVE-2025-54892.md): A user with elevated privileges can inject XSS in the SNMP traps group configuration page (CVSS 6.8)
- [CVE-2025-54889](https://cve.now/CVE-2025-54889.md): A user with elevated privileges can inject XSS in the SNMP traps manufacturer configuration page (CVSS 6.8)
- [CVE-2025-5946](https://cve.now/CVE-2025-5946.md): RCE via the poller reload feature available only to user with high privilege (CVSS 7.2)
- [CVE-2025-8428](https://cve.now/CVE-2025-8428.md): XSS found in the HTTP loader widget (CVSS 6.8)
- [CVE-2025-6791](https://cve.now/CVE-2025-6791.md): Second order SQL injection available to user with low privilege (CVSS 8.8)
- [CVE-2025-4650](https://cve.now/CVE-2025-4650.md): User with high privileges is able to introduce a SQLi using the Meta Service indicator page (CVSS 7.2)
- [CVE-2025-4649](https://cve.now/CVE-2025-4649.md): ACL are not correctly taken into account in the display of the "event logs" page. This page requiring, high privileges, will display all available logs. (CVSS 4.9)
- [CVE-2025-4648](https://cve.now/CVE-2025-4648.md): A user with elevated privileges can inject XSS by altering the content of a SVG media during the submit request. (CVSS 8.4)
- [CVE-2025-4647](https://cve.now/CVE-2025-4647.md): A user with elevated privileges can bypass sanitization measures by replacing the content of an existing SVG (CVSS 8.4)
- [CVE-2025-4646](https://cve.now/CVE-2025-4646.md): A high privilege user is able to create and use a valid admin API token in centreon-web (CVSS 7.2)
- [CVE-2025-3872](https://cve.now/CVE-2025-3872.md): Privilege escalation by altering payload in contact form (CVSS 7.2)
- [CVE-2025-3767](https://cve.now/CVE-2025-3767.md): SQL Injection in Centreon BAM boolean KPI listing (CVSS 7.2)
- [CVE-2024-5725](https://cve.now/CVE-2024-5725.md): Centreon initCurveList SQL Injection Remote Code Execution Vulnerability (CVSS 8.8)
- [CVE-2024-5723](https://cve.now/CVE-2024-5723.md): Centreon updateServiceHost SQL Injection Remote Code Execution Vulnerability (CVSS 8.8)
- [CVE-2023-51633](https://cve.now/CVE-2023-51633.md): Centreon sysName Cross-Site Scripting Remote Code Execution Vulnerability (CVSS 7.5)
- [CVE-2024-23119](https://cve.now/CVE-2024-23119.md): Centreon insertGraphTemplate SQL Injection Remote Code Execution Vulnerability (CVSS 8.8)
- [CVE-2024-23118](https://cve.now/CVE-2024-23118.md): Centreon updateContactHostCommands SQL Injection Remote Code Execution Vulnerability (CVSS 7.2)
- [CVE-2024-23117](https://cve.now/CVE-2024-23117.md): Centreon updateContactServiceCommands SQL Injection Remote Code Execution Vulnerability (CVSS 7.2)
- [CVE-2024-23116](https://cve.now/CVE-2024-23116.md): Centreon updateLCARelation SQL Injection Remote Code Execution Vulnerability (CVSS 7.2)
- [CVE-2024-23115](https://cve.now/CVE-2024-23115.md): Centreon updateGroups SQL Injection Remote Code Execution Vulnerability (CVSS 7.2)
- [CVE-2024-0637](https://cve.now/CVE-2024-0637.md): Centreon updateDirectory SQL Injection Remote Code Execution Vulnerability (CVSS 8.8)
- [CVE-2022-42429](https://cve.now/CVE-2022-42429.md): This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. (CVSS 7.2)
- [CVE-2022-42428](https://cve.now/CVE-2022-42428.md): This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. (CVSS 7.2)
- [CVE-2022-42427](https://cve.now/CVE-2022-42427.md): This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. (CVSS 7.2)
- [CVE-2022-42426](https://cve.now/CVE-2022-42426.md): This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. (CVSS 7.2)
- [CVE-2022-42425](https://cve.now/CVE-2022-42425.md): This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. (CVSS 7.2)
- [CVE-2022-42424](https://cve.now/CVE-2022-42424.md): This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. (CVSS 7.2)
- [CVE-2022-41142](https://cve.now/CVE-2022-41142.md): This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. (CVSS 7.2)
- [CVE-2022-34872](https://cve.now/CVE-2022-34872.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of Centreon. (CVSS 6.5)
- [CVE-2022-34871](https://cve.now/CVE-2022-34871.md): This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. (CVSS 7.2)
- [CVE-2012-5967](https://cve.now/CVE-2012-5967.md): SQL injection vulnerability in menuXML.php in Centreon 2.3.3 through 2.3.9-4 (fixed in Centreon web 2.6.0) allows remote authenticated users (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/centreon
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.