CVE-2025-4647: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Centreon web allows Reflected XSS. A user with elevated privileges can bypass sanitization measures by replacing the content of an existing SVG. This issue affects web: from 24.10.0 before...

CVE-2025-4648: Unrestricted Upload of File with Dangerous Type

The content of a SVG file, received as input in Centreon web, was not properly checked. Allows Reflected XSS. A user with elevated privileges can inject JS script by altering the content of a SVG media, during the submit request. This issue affects web: from 24.10.0 before 24.10.5, from 24.04.0...

PT-2025-20842

Name of the Vulnerable Software and Affected Versions: Centreon web versions 24.04.0 through 24.04.9 Centreon web versions 24.10.0 through 24.10.3 Description: The issue is related to Improper Privilege Management in the API Token creation form modules, allowing Privilege Escalation...

Centreon 安全漏洞

Centreon is a set of open source system monitoring tools from the French company Centreon . The product provides monitoring capabilities for network, system and application resources. A security vulnerability exists in Centreon that stems from insufficient integrity checking of code downloads,...

CVE-2025-4649: Improper Handling of Exceptional Conditions

Improper Handling of Exceptional Conditions vulnerability in Centreon web allows Privilege Escalation. ACL are not correctly taken into account in the display of the "event logs" page. This page requiring, high privileges, will display all available logs. This issue affects web: from 24.10.3 befo...

PT-2025-20880

Name of the Vulnerable Software and Affected Versions: Centreon web versions 22.10.0 through 22.10.28 Centreon web versions 23.04.0 through 23.04.26 Centreon web versions 23.10.0 through 23.10.21 Centreon web versions 24.04.0 through 24.04.10 Centreon web versions 24.10.0 through 24.10.4...

CVE-2025-3872

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Centreon centreon-web User configuration form modules allows SQL Injection. A user with high privileges is able to become administrator by intercepting the contact form request and altering its...

CVE-2025-3767

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Centreon BAM Boolean KPi Listing modules allows SQL Injection. This page is only accessible to authenticated users with high privileges. This issue affects Centreon BAM: from 24.10 before 24.10.1,...

CVE-2025-3872

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Centreon centreon-web User configuration form modules allows SQL Injection. A user with high privileges is able to become administrator by intercepting the contact form request and altering its...

CVE-2025-3872 Privilege escalation by altering payload in contact form

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Centreon centreon-web User configuration form modules allows SQL Injection. A user with high privileges is able to become administrator by intercepting the contact form request and altering its...

CVE-2025-3872 Privilege escalation by altering payload in contact form

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Centreon centreon-web User configuration form modules allows SQL Injection. A user with high privileges is able to become administrator by intercepting the contact form request and altering its...

CVE-2025-3872

CVE-2025-3872 is an SQL Injection vulnerability in Centreon centreon-web (User configuration form modules) that allows a high-privilege user to elevate to administrator by tampering the contact form payload. The issue affects Centreon Web versions listed by PT-Security (22.10.0–27, 23.04.0–23.04....

CVE-2025-3872

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Centreon centreon-web User configuration form modules allows SQL Injection. A user with high privileges is able to become administrator by intercepting the contact form request and altering its...

CVE-2025-3872 Privilege escalation by altering payload in contact form

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Centreon centreon-web User configuration form modules allows SQL Injection. A user with high privileges is able to become administrator by intercepting the contact form request and altering its...

CVE-2025-3872: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Centreon centreon-web User configuration form modules allows SQL Injection. A user with high privileges is able to become administrator by intercepting the contact form request and altering its...

Centreon 安全漏洞

Centreon is a set of open source system monitoring tools from the French company Centreon . The product provides monitoring capabilities for resources such as networks, systems and applications. Centreon suffers from a security vulnerability that originates from SQL injection and could lead to...

PT-2025-17722

Name of the Vulnerable Software and Affected Versions Centreon centreon-web versions 22.10.0 through 22.10.27 Centreon centreon-web versions 23.04.0 through 23.04.24 Centreon centreon-web versions 23.10.0 through 23.10.19 Centreon centreon-web versions 24.04.0 through 24.04.9 Centreon centreon-we...

CVE-2025-3767

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Centreon BAM Boolean KPi Listing modules allows SQL Injection. This page is only accessible to authenticated users with high privileges. This issue affects Centreon BAM: from 24.10 before 24.10.1,...

CVE-2025-3767

CVE-2025-3767 is an SQL Injection in Centreon BAM’s Boolean KPI Listing modules caused by improper neutralization of special elements in SQL commands. Affected: Centreon BAM versions 24.10 (before 24.10.1), 24.04 (before 24.04.5), 23.10 (before 23.10.10), and 23.04 (before 23.04.10). Root cause: ...

CVE-2025-3767 SQL Injection in Centreon BAM boolean KPI listing

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Centreon BAM Boolean KPi Listing modules allows SQL Injection. This page is only accessible to authenticated users with high privileges. This issue affects Centreon BAM: from 24.10 before 24.10.1,...