CVE-2025-54890

Summary: Stored XSS in Centreon Infra Monitoring for the Hostgroup configuration page due to improper input neutralization. Affected software: Centreon Infra Monitoring. Vulnerable versions (per sources): 23.10.0–23.10.29, 24.04.0–24.04.19, 24.10.0–24.10.15. Impact (as stated): Stored XSS by user...

CVE-2025-12514 A user with elevated privileges is able to introduce a SQL Injection using the Open-tickets Notification rules configuration parameters

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Centreon Infra Monitoring - Open-tickets Notification rules configuration parameters, Open tickets modules allows SQL Injection to user with elevated privileges.This issue affects Infra Monitoring ...

CVE-2025-12514

CVE-2025-12514 affects Centreon Infra Monitoring - Open-tickets (Notification rules configuration parameters, Open tickets modules). The root cause is improper neutralization of special elements in SQL commands, enabling SQL Injection. Affected versions are 23.10.0–23.10.4, 24.04.0–24.04.5, and 2...

CVE-2025-12514 A user with elevated privileges is able to introduce a SQL Injection using the Open-tickets Notification rules configuration parameters

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Centreon Infra Monitoring - Open-tickets Notification rules configuration parameters, Open tickets modules allows SQL Injection to user with elevated privileges.This issue affects Infra Monitoring ...

EUVD-2025-204709

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Centreon Infra Monitoring - Open-tickets Notification rules configuration parameters, Open tickets modules allows SQL Injection to user with elevated privileges.This issue affects Infra Monitoring ...

CVE-2025-12514 A user with elevated privileges is able to introduce a SQL Injection using the Open-tickets Notification rules configuration parameters

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Centreon Infra Monitoring - Open-tickets Notification rules configuration parameters, Open tickets modules allows SQL Injection to user with elevated privileges.This issue affects Infra Monitoring ...

EUVD-2025-204710

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Centreon Infra Monitoring Notification rules, Open tickets module allows Stored XSS by users with elevated privileges.This issue affects Infra Monitoring: from 24.10.0 before 24.10.5, from...

CVE-2025-8460 A user with elevated privileges can inject XSS in the Notification rules configuration page

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Centreon Infra Monitoring Notification rules, Open tickets module allows Stored XSS by users with elevated privileges.This issue affects Infra Monitoring: from 24.10.0 before 24.10.5, from...

CVE-2025-8460 A user with elevated privileges can inject XSS in the Notification rules configuration page

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Centreon Infra Monitoring Notification rules, Open tickets module allows Stored XSS by users with elevated privileges.This issue affects Infra Monitoring: from 24.10.0 before 24.10.5, from...

PT-2025-52643

Name of the Vulnerable Software and Affected Versions Centreon Infra Monitoring - Open-tickets versions 23.10.0 through 23.10.4 Centreon Infra Monitoring - Open-tickets versions 24.04.0 through 24.04.5 Centreon Infra Monitoring - Open-tickets versions 24.10.0 through 24.10.5 Description A flaw...

PT-2025-52645

Name of the Vulnerable Software and Affected Versions Centreon Infra Monitoring versions 23.10.0 through 23.10.4 Centreon Infra Monitoring versions 24.04.0 through 24.04.5 Centreon Infra Monitoring versions 24.10.0 through 24.10.5 Description The software contains an Improper Neutralization of...

Centreon 安全漏洞

Centreon is a set of open source system monitoring tools from the French company Centreon . The product provides monitoring capabilities for network, system and application resources. A security vulnerability exists in Centreon version 24.10.0 up to and including version 24.10.5, version 24.04.0 ...

Centreon 安全漏洞

Centreon is a set of open source system monitoring tools from the French company Centreon . The product provides monitoring capabilities for network, system and application resources. A security vulnerability exists in Centreon versions 24.10.0 through 24.10.5, 24.04.0 through 24.04.5, and 23.10....

PT-2025-52644

Name of the Vulnerable Software and Affected Versions Centreon Infra Monitoring versions 23.10.0 through 23.10.29 Centreon Infra Monitoring versions 24.04.0 through 24.04.19 Centreon Infra Monitoring versions 24.10.0 through 24.10.15 Description The software contains an Improper Neutralization of...

Centreon 安全漏洞

Centreon is a set of open source system monitoring tools from the French company Centreon . The product provides monitoring capabilities for resources such as networks, systems and applications. A security vulnerability exists in Centreon versions 24.10.0 to before 24.10.15, 24.04.0 to before...

Metasploit Wrap-Up 11/07/2025

New module content 3 Centreon authenticated command injection leading to RCE via broker engine "reload" parameter Author: h00die-gr3y [email protected] Type: Exploit Pull request: 20672 contributed by h00die-gr3y Path: linux/http/centreonauthrcecve20255946 AttackerKB reference: CVE-2025-5946...

Centreon authenticated command injection leading to RCE via broker engine "reload" parameter

Centreon is a platform designed to monitor your cloud and on-premises infrastructure. This module exploits an command injection vulnerability using the broker engine reload setting on the poller configuration page of the Centreon web application. Injecting a malcious payload at the broker engine...

📄 Centreon Broker Engine Reload Parameter Command Injection

Centreon is a platform designed to monitor your cloud and on-premises infrastructure. This Metasploit module exploits a command injection vulnerability using the broker engine reload setting on the poller configuration page of the Centreon web application. Injecting a malicious payload at the...

CVE-2025-10023

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Centreon Infra Monitoring Services Meta-services modules allows Stored XSS by users with elevated privileges.This issue affects Infra Monitoring: from 24.10.0 before 24.10.9, from 24.04.0...

CVE-2025-8432

Incorrect Default Permissions vulnerability in Centreon Infra Monitoring MBI modules allows Embedding Scripts within Scripts by CentreonBI user account on the MBI server This issue affects Infra Monitoring: from 24.10.0 before 24.10.6, from 24.04.0 before 24.04.9, from 23.10.0 before 23.10.15...