Log in Start free

Centreon

Products

ProductCVEsExploitedLatest
Centreon22–Oct 29, 2026
Infra Monitoring21–Jul 13, 2026
web6–Aug 22, 2025
Centreon Open Tickets on Central Server2–Feb 27, 2026
Centreon Web on Central Server1–Feb 27, 2026
Centreon BAM1–Apr 22, 2025
Infra Monitoring - Open-tickets1–Dec 22, 2025

Exploited and recent CVEs

  • CVE-2026-11587 High 7.2 Authenticated SQL Injection via PHP Array Key in ACL Management (Resources & Actions) — Centreon 26.03.0 0.3%
  • CVE-2025-12523 Medium 6.5 Broken Object Level Authorization in Users Configuration Endpoint (/centreon/api/latest/configuration/users) – Sensitive Information Disclosure 0.2%
  • CVE-2025-13050 Medium 5.4 Broken Function Level Authorization — `postcommand.php` allows execution of poller post-restart commands by non-admin users 0.3%
  • CVE-2026-14453 Critical 9.6 A user with low privileges can inject SSTI templates that can lead to RCE in open-tickets 0.8%
  • CVE-2026-2749 Critical 9.9 Path traversal in Centreon Open Tickets 0.6%
  • CVE-2026-2750 Critical 9.1 Command Injection via CLAPI generatetraps 0.3%
  • CVE-2026-2751 High 8.3 Blind SQL Injection 0.3%
  • CVE-2025-15029 Critical 9.8 An unauthenticated user is able to introduce SQL Injection using the Awie export module 13.0%
  • CVE-2025-15026 Critical 9.8 Unauthenticated configuration import allows administrative account creation using AWIE component 0.4%
  • CVE-2025-12511 Medium 6.8 A user with elevated privileges can inject XSS in the DSM Administration’s Extensions configuration page 0.2%
  • CVE-2025-12513 Medium 6.8 A user with elevated privileges can inject XSS in the Hosts configuration parameters page 0.2%
  • CVE-2025-12519 Medium 5.3 Information disclosure on Administration parameters API endpoint 0.2%
  • CVE-2025-13056 Medium 6.8 A user with elevated privileges can inject XSS in the Administration ACL Menus configuration page 0.2%
  • CVE-2025-5965 High 7.2 RCE via the backup feature available only to user with high privilege 28.2%
  • CVE-2025-54890 Medium 6.8 A user with elevated privileges can inject XSS in the Hostgroups configuration page 0.2%
  • CVE-2025-12514 High 7.2 A user with elevated privileges is able to introduce a SQL Injection using the Open-tickets Notification rules configuration parameters 0.3%
  • CVE-2025-8460 Medium 6.8 A user with elevated privileges can inject XSS in the Notification rules configuration page 0.2%
  • CVE-2025-10023 Medium 6.2 A user with elevated privileges can inject XSS in the Services Meta-services configuration page 0.2%
  • CVE-2025-8432 High 8.4 CentreonBI user account on the MBI server can execute commands as root by modifying script runned by the CRON 0.4%
  • CVE-2025-8459 High 7.7 A user with low privileges can inject XSS in the Monitoring Recurrent downtimes page 0.3%
  • CVE-2025-8430 Medium 6.8 A user with elevated privileges can inject XSS in the Commands Connectors configuration configuration page 0.2%
  • CVE-2025-8429 Medium 6.8 A user with elevated privileges can inject XSS in the ACL Action access configuration page 0.2%
  • CVE-2025-54893 Medium 6.8 A user with elevated privileges can inject XSS in the Hosts templates configuration page 0.2%
  • CVE-2025-54891 Medium 6.8 A user with elevated privileges can inject XSS in the ACL Resource Access configuration page 0.3%
  • CVE-2025-54892 Medium 6.8 A user with elevated privileges can inject XSS in the SNMP traps group configuration page 0.3%
  • CVE-2025-54889 Medium 6.8 A user with elevated privileges can inject XSS in the SNMP traps manufacturer configuration page 0.3%
  • CVE-2025-5946 High 7.2 RCE via the poller reload feature available only to user with high privilege 13.5%
  • CVE-2025-8428 Medium 6.8 XSS found in the HTTP loader widget 0.3%
  • CVE-2025-6791 High 8.8 Second order SQL injection available to user with low privilege 0.3%
  • CVE-2025-4650 High 7.2 User with high privileges is able to introduce a SQLi using the Meta Service indicator page 0.4%