Product
centreon
127 known vulnerabilities across versions
Vulnerabilities are listed by affected version. Select any CVE for the full briefing and its intelligence graph.
CVE-2026-2749
CVE-2026-2751
CVE-2025-15029
CVE-2025-15026
CVE-2025-12513
CVE-2025-13056
CVE-2025-12519
CVE-2025-5965
CVE-2025-8460
CVE-2025-54890
CVE-2025-12514
CVE-2025-10023
CVE-2025-8459
CVE-2025-8430
CVE-2025-8429
CVE-2025-54893
CVE-2025-8428
CVE-2025-5946
CVE-2025-54892
CVE-2025-54891
CVE-2025-54889
CVE-2025-6791
CVE-2025-4650
CVE-2025-4649
CVE-2025-4648
CVE-2025-4647
CVE-2025-4646
CVE-2025-3872
CVE-2024-55573
CVE-2024-53923
CVE-2024-39843
CVE-2024-39842
CVE-2024-39841
CVE-2024-33854
CVE-2024-33853
CVE-2024-33852
CVE-2024-32501
CVE-2024-5725
CVE-2024-5723
CVE-2023-51633
CVE-2024-23119
CVE-2024-23118
CVE-2024-23117
CVE-2024-23116
CVE-2024-23115
CVE-2024-0637
CVE-2022-42429
CVE-2022-42428
CVE-2022-42427
CVE-2022-42426
CVE-2022-42425
CVE-2022-42424
CVE-2022-41142
CVE-2022-3827
CVE-2022-39988
CVE-2022-40044
CVE-2022-40043
CVE-2022-36194
CVE-2022-34872
CVE-2022-34871
CVE-2020-22345
CVE-2021-37558
CVE-2021-37557
CVE-2021-37556
CVE-2021-28053
CVE-2021-28054
CVE-2021-27676
CVE-2021-26804
CVE-2021-28055
CVE-2020-22425
CVE-2020-13628
CVE-2020-13627
CVE-2020-10946
CVE-2020-10945
CVE-2020-13252
CVE-2019-19699
CVE-2019-19487
CVE-2019-19486
CVE-2019-19484
CVE-2019-17647
CVE-2019-17646
CVE-2019-17645
CVE-2019-17642
CVE-2019-17644
CVE-2019-17643
CVE-2020-9463
CVE-2019-15299
CVE-2019-20327
CVE-2019-15300
CVE-2019-15298
CVE-2019-16195
CVE-2019-16406
CVE-2019-16405
CVE-2019-17501
CVE-2019-17105
CVE-2018-21024
CVE-2019-17108
CVE-2019-17107
CVE-2019-17106
CVE-2018-21023
CVE-2018-21022
CVE-2018-21021
CVE-2018-21020
CVE-2019-16194
CVE-2019-13024
CVE-2018-19312
CVE-2018-19311
CVE-2018-19281
CVE-2018-19280
CVE-2018-19271
CVE-2018-11589
CVE-2018-11588
CVE-2018-11587
CVE-2015-7672
CVE-2015-1561
CVE-2015-1560
CVE-2014-3829
CVE-2014-3828
CVE-2012-5967
CVE-2011-4432
CVE-2011-4431
CVE-2010-1301
CVE-2009-4368
CVE-2008-1179
CVE-2008-1178
CVE-2008-1119
CVE-2007-6485
< 24.04.7
Vulnerability in Centreon Open Tickets on Central Server on Linux (Centroen Open Ticket modules).This issue affects Centr
>= 24.04.0 and < 24.04.24.
Blind SQL Injection via unsanitized array keys in Service Dependencies deletion. Vulnerability in Centreon Web on Central
>= 24.04.0 and < 24.04.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon Infra Monitoring (A
>= 24.04.0 and < 24.04.3
Missing Authentication for Critical Function vulnerability in Centreon Infra Monitoring centreon-awie (Awie import module) allows
>= 24.04.0 and < 24.04.19
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monito
>= 24.04.0 and < 24.04.19
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monito
>= 24.04.0 and < 24.04.19
Missing Authorization vulnerability in Centreon Infra Monitoring (Administration parameters API endpoint modules) allows Accessing
>= 24.04.0 and < 24.04.19
In the backup parameters, a user with high privilege is able to concatenate custom instructions to the backup setup. Improper Neut
>= 23.10.0 and < 23.10.4
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monito
>= 23.10.0 and < 23.10.29
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monito
>= 23.10.0 and < 23.10.4
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon Infra Monitoring -
>= 23.10.0 and < 23.10.26
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monito
>= 23.10.0 and < 23.10.28
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monito
>= 23.10.0 and < 23.10.28
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monito
>= 23.10.0 and < 23.10.28
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monito
>= 23.10.0 and < 23.10.28
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monito
>= 23.10.0 and < 23.10.28
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monito
>= 23.10.0 and < 23.10.28
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Centreon Infra Monitor
>= 23.10.0 and < 23.10.28
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monito
>= 23.10.0 and < 23.10.28
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monito
>= 23.10.0 and < 23.10.28
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monito
>= 23.10.0 and < 23.10.26
In the monitoring event logs page, it is possible to alter the http request to insert a reflect payload in the DB. Caused by an Im
>= 23.10.0 and < 23.10.26
User with high privileges is able to introduce a SQLi using the Meta Service indicator page. Caused by an Improper Neutralization
>= 23.04.24 and < 23.04.26
Improper Handling of Exceptional Conditions vulnerability in Centreon web allows Privilege Escalation. ACL are not correctly ta
>= 22.10.0 and < 22.10.29
The content of a SVG file, received as input in Centreon web, was not properly checked. Allows Reflected XSS. A user with elevat
>= 22.10.0 and < 22.10.29
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon web allows R
>= 24.04.0 and < 24.04.10
Incorrect Authorization vulnerability in Centreon web (API Token creation form modules) allows Privilege Escalation.This issue aff
>= 22.10.0 and < 22.10.28
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon centreon-web (User
>= 23.04.0 and < 23.04.24
An issue was discovered in Centreon centreon-web 24.10.x before 24.10.3, 24.04.x before 24.04.9, 23.10.x before 23.10.19, 23.04.x
>= 23.04.0 and < 23.04.24
An issue was discovered in Centreon Web 24.10.x before 24.10.3, 24.04.x before 24.04.9, 23.10.x before 23.10.19, 23.04.x before 23
all versions
A SQL injection vulnerability in Centreon 24.04.2 allows a remote high-privileged attacker to execute arbitrary SQL command via cr
all versions
A SQL injection vulnerability in Centreon 24.04.2 allows a remote high-privileged attacker to execute arbitrary SQL command via us
>= 22.10.0 and < 22.10.23
A SQL Injection vulnerability exists in the service configuration functionality in Centreon Web 24.04.x before 24.04.3, 23.10.x be
>= 22.10.0 and < 22.10.23
A SQL Injection vulnerability exists in the Graph Template component in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.
>= 22.10.0 and < 22.10.23
A SQL Injection vulnerability exists in the Timeperiod component in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13,
>= 22.10.0 and < 22.10.23
A SQL Injection vulnerability exists in the Downtime component in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23
>= 22.10.0 and < 22.10.23
A SQL Injection vulnerability exists in the updateServiceHost functionality in Centreon Web 24.04.x before 24.04.3, 23.10.x before
< 22.10.23
Centreon initCurveList SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute ar
< 22.04.24
Centreon updateServiceHost SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execut
< 22.10.15
Centreon sysName Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute a
< 22.04.19
Centreon insertGraphTemplate SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to exec
< 22.04.19
Centreon updateContactHostCommands SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers t
< 22.04.19
Centreon updateContactServiceCommands SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attacker
< 22.04.19
Centreon updateLCARelation SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execut
< 22.04.19
Centreon updateGroups SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arb
< 22.04.19
Centreon updateDirectory SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute
< 21.04.19
This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is require
< 21.04.19
This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is require
< 21.10.11
This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is require
< 21.04.19
This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is require
< 21.04.19
This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is require
< 21.04.19
This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is require
all versions
This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is require
< 22.10.0
A vulnerability was found in centreon. It has been declared as critical. This vulnerability affects unknown code of the file formC
all versions
A cross-site scripting (XSS) vulnerability in Centreon 22.04.0 allows attackers to execute arbitrary web script or HTML via a craf
all versions
Centreon v20.10.18 was discovered to contain a cross-site scripting (XSS) vulnerability via the esc_name (Escalation Name) paramet
all versions
Centreon v20.10.18 was discovered to contain a SQL injection vulnerability via the esc_name (Escalation Name) parameter at Configu
all versions
Centreon 22.04.0 is vulnerable to Cross Site Scripting (XSS) from the function Pollers > Broker Configuration by adding a crafted
all versions
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Centreon. Authentication
all versions
This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is require
all versions
/graphStatus/displayServiceStatus.php in Centreon 19.10.8 allows remote attackers to execute arbitrary OS commands via shell metac
< 20.04.14
A SQL injection vulnerability in a MediaWiki script in Centreon before 20.04.14, 20.10.8, and 21.04.2 allows remote unauthenticate
< 20.04.14
A SQL injection vulnerability in image generation in Centreon before 20.04.14, 20.10.8, and 21.04.2 allows remote authenticated (b
< 20.04.14
A SQL injection vulnerability in reporting export in Centreon before 20.04.14, 20.10.8, and 21.04.2 allows remote authenticated (b
all versions
An issue was discovered in Centreon-Web in Centreon Platform 20.10.0. A SQL injection vulnerability in "Configuration > Users > Co
all versions
An issue was discovered in Centreon-Web in Centreon Platform 20.10.0. A Stored Cross-Site Scripting (XSS) issue in "Configuration
all versions
Centreon version 20.10.2 is affected by a cross-site scripting (XSS) vulnerability. The dep_description (Dependency Description) a
all versions
Insecure Permissions in Centreon Web versions 19.10.18, 20.04.8, and 20.10.2 allows remote attackers to bypass validation by chang
all versions
An issue was discovered in Centreon-Web in Centreon Platform 20.10.0. The anti-CSRF token generation is predictable, which might a
all versions
Centreon 19.10-3.el7 is affected by a SQL injection vulnerability, where an authorized user is able to inject additional SQL queri
< 1.6.4
Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the widgetId parameter
< 1.6.4
Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the widgetId parameter
< 1.6.4
Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the page parameter to
<= 2.8.2
Centreon before 19.10.7 exposes Session IDs in server responses.
>= 19.04.0 and < 19.04.15
Centreon before 19.04.15 allows remote attackers to execute arbitrary OS commands by placing shell metacharacters in RRDdatabase_s
<= 19.10
There is Authenticated remote code execution in Centreon Infrastructure Monitoring Software through 19.10 via Pollers misconfigura
<= 19.04.4
Command Injection in minPlayCommand.php in Centreon (19.04.4 and below) allows an attacker to achieve command injection via a plug
<= 19.04.4
Local File Inclusion in minPlayCommand.php in Centreon (19.04.4 and below) allows an attacker to traverse paths via a plugin test.
<= 19.04.4
Open redirect via parameter ‘p’ in login.php in Centreon (19.04.4 and below) allows an attacker to craft a payload and execute
< 2.8.30
An issue was discovered in Centreon before 2.8.30, 18.10.8, 19.04.5, and 19.10.2. SQL Injection exists via the include/monitoring/
>= 18.0.0 and < 18.10.8
An issue was discovered in Centreon before 18.10.8, 19.04.5, and 19.10.2. It provides sensitive information via an unauthenticated
< 2.8.31
An issue was discovered in Centreon before 2.8.31, 18.10.9, 19.04.6, and 19.10.3. It provides sensitive information via an unauthe
>= 18.0.0 and < 18.10.8
An issue was discovered in Centreon before 18.10.8, 19.10.1, and 19.04.2. It allows CSRF with resultant remote command execution v
< 2.8.30
An issue was discovered in Centreon before 2.8-30, 18.10-8, 19.04-5, and 19.10-2.. It provides sensitive information via an unauth
< 2.8.30
An issue was discovered in Centreon before 2.8-30,18.10-8, 19.04-5, and 19.10-2. It provides sensitive information via an unauthen
all versions
Centreon 19.10 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the server_ip field
<= 19.04.3
An issue was discovered in Centreon Web through 19.04.3. When a user changes his password on his profile page, the contact_autolog
<= 19.10
Insecure permissions in cwrapper_perl in Centreon Infrastructure Monitoring Software through 19.10 allow local attackers to gain p
>= 2.8.1 and < 2.8.30
A problem was found in Centreon Web through 19.04.3. An authenticated SQL injection is present in the page include/Administration/
>= 2.8.1 and < 2.8.30
A problem was found in Centreon Web through 19.04.3. An authenticated command injection is present in the page include/configurati
>= 2.8.0 and < 2.8.30
Centreon before 2.8.30, 18.x before 18.10.8, and 19.x before 19.04.5 allows XSS via myAccount alias and name fields.
all versions
Centreon Web 19.04.4 has weak permissions within the OVA (aka VMware virtual machine) and OVF (aka VirtualBox virtual machine) fil
< 2.8.30
Centreon Web before 2.8.30, 18.10.x before 18.10.8, 19.04.x before 19.04.5 and 19.10.x before 19.10.2 allows Remote Code Execution
all versions
Centreon 19.04 allows attackers to execute arbitrary OS commands via the Command Line field of main.php?p=60807&type=4 (aka the Co
>= 2.8 and < 2.8.27
The token generator in index.php in Centreon Web before 2.8.27 is predictable.
< 2.8.27
licenseUpload.php in Centreon Web before 2.8.27 allows attackers to upload arbitrary files via a POST request.
>= 2.8 and < 2.8.28
Local file inclusion in brokerPerformance.php in Centreon Web before 2.8.28 allows attackers to disclose information or perform a
>= 2.8 and < 2.8.27
minPlayCommand.php in Centreon Web before 2.8.27 allows authenticated attackers to execute arbitrary code via the command_hostaddr
<= 2.8.29
In Centreon Web through 2.8.29, disclosure of external components' passwords allows authenticated attackers to move laterally to e
>= 2.8 and < 2.8.28
getStats.php in Centreon Web before 2.8.28 allows authenticated attackers to execute arbitrary code via the ns_id parameter.
< 2.8.28
makeXML_ListServices.php in Centreon Web before 2.8.28 allows attackers to perform SQL injections via the host_id parameter.
< 2.8.27
img_gantt.php in Centreon Web before 2.8.27 allows attackers to perform SQL injections via the host_id parameter.
< 2.8.27
In very rare cases, a PHP type juggling vulnerability in centreonAuth.class.php in Centreon Web before 2.8.27 allows attackers to
<= 19.04.0
SQL injection vulnerabilities in Centreon through 19.04 allow attacks via the svc_id parameter in include/monitoring/status/Servic
all versions
Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows the attacker to execute arbitrary system
>= 3.4.0 and <= 3.4.9
Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.24) allows SQL Injection via the searchVM parameter to the main.php
>= 3.4.0 and <= 3.4.9
Centreon 3.4.x (fixed in Centreon 18.10.0) allows XSS via the Service field to the main.php?p=20201 URI, as demonstrated by the "M
all versions
Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.27) allows SNMP trap SQL Injection.
>= 3.4.0 and <= 3.4.9
Centreon 3.4.x (fixed in Centreon 18.10.0) has XSS via the resource name or macro expression of a poller macro.
all versions
Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.28) allows SQL Injection via the main.php searchH parameter.
all versions
Multiple SQL injection vulnerabilities in Centreon 3.4.6 including Centreon Web 2.8.23 allow attacks via the searchU parameter in
all versions
Centreon 3.4.6 including Centreon Web 2.8.23 is vulnerable to an authenticated user injecting a payload into the username or comma
all versions
There is Remote Code Execution in Centreon 3.4.6 including Centreon Web 2.8.23 via the RPN value in the Virtual Metric form in cen
all versions
Cross-site scripting (XSS) vulnerability in Centreon 2.6.1 (fixed in Centreon 18.10.0 and Centreon web 2.8.27).
<= 2.5.4
The escape_command function in include/Administration/corePerformance/getStats.php in Centreon (formerly Merethis Centreon) 2.5.4
<= 2.5.4
SQL injection vulnerability in the isUserAdmin function in include/common/common-Func.php in Centreon (formerly Merethis Centreon)
all versions
displayServiceStatus.php in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3) allows remote attacker
all versions
Multiple SQL injection vulnerabilities in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3) allow re
all versions
SQL injection vulnerability in menuXML.php in Centreon 2.3.3 through 2.3.9-4 (fixed in Centreon web 2.6.0) allows remote authentic
<= 2.3.1
www/include/configuration/nconfigObject/contact/DB-Func.php in Merethis Centreon before 2.3.2 does not use a salt during calculati
<= 2.3.1
Directory traversal vulnerability in main.php in Merethis Centreon before 2.3.2 allows remote authenticated users to execute arbit
all versions
SQL injection vulnerability in main.php in Centreon 2.1.5 allows remote attackers to execute arbitrary SQL commands via the host_i
<= 2.1.3
Multiple unspecified vulnerabilities in Centreon before 2.1.4 have unknown impact and attack vectors in the (1) ping tool, (2) tra
<= 1.4.2.3
Multiple cross-site scripting (XSS) vulnerabilities in include/common/javascript/color_picker.php in Centreon 1.4.2.3 and earlier
<= 1.4.2.3
Directory traversal vulnerability in include/doc/index.php in Centreon 1.4.2.3 and earlier allows remote attackers to read arbitra
<= 1.4.2.3
Directory traversal vulnerability in include/doc/get_image.php in Centreon 1.4.2.3 and earlier allows remote attackers to read arb
all versions
Multiple PHP remote file inclusion vulnerabilities in Centreon 1.4.1 (aka Oreon 1.4) allow remote attackers to execute arbitrary P