Centreon Infra Monitoring

• CVE-2026-14453 Critical 9.6 A user with low privileges can inject SSTI templates that can lead to RCE in open-tickets 0.8%
• CVE-2025-15029 Critical 9.8 An unauthenticated user is able to introduce SQL Injection using the Awie export module 13.0%
• CVE-2025-15026 Critical 9.8 Unauthenticated configuration import allows administrative account creation using AWIE component 0.4%
• CVE-2025-12511 Medium 6.8 A user with elevated privileges can inject XSS in the DSM Administration’s Extensions configuration page 0.2%
• CVE-2025-12513 Medium 6.8 A user with elevated privileges can inject XSS in the Hosts configuration parameters page 0.2%
• CVE-2025-12519 Medium 5.3 Information disclosure on Administration parameters API endpoint 0.2%
• CVE-2025-13056 Medium 6.8 A user with elevated privileges can inject XSS in the Administration ACL Menus configuration page 0.2%
• CVE-2025-5965 High 7.2 RCE via the backup feature available only to user with high privilege 28.2%
• CVE-2025-54890 Medium 6.8 A user with elevated privileges can inject XSS in the Hostgroups configuration page 0.2%
• CVE-2025-8460 Medium 6.8 A user with elevated privileges can inject XSS in the Notification rules configuration page 0.2%
• CVE-2025-10023 Medium 6.2 A user with elevated privileges can inject XSS in the Services Meta-services configuration page 0.2%
• CVE-2025-8432 High 8.4 CentreonBI user account on the MBI server can execute commands as root by modifying script runned by the CRON 0.4%
• CVE-2025-8459 High 7.7 A user with low privileges can inject XSS in the Monitoring Recurrent downtimes page 0.3%
• CVE-2025-8430 Medium 6.8 A user with elevated privileges can inject XSS in the Commands Connectors configuration configuration page 0.2%
• CVE-2025-8429 Medium 6.8 A user with elevated privileges can inject XSS in the ACL Action access configuration page 0.2%
• CVE-2025-54893 Medium 6.8 A user with elevated privileges can inject XSS in the Hosts templates configuration page 0.2%
• CVE-2025-54891 Medium 6.8 A user with elevated privileges can inject XSS in the ACL Resource Access configuration page 0.3%
• CVE-2025-54892 Medium 6.8 A user with elevated privileges can inject XSS in the SNMP traps group configuration page 0.3%
• CVE-2025-54889 Medium 6.8 A user with elevated privileges can inject XSS in the SNMP traps manufacturer configuration page 0.3%
• CVE-2025-5946 High 7.2 RCE via the poller reload feature available only to user with high privilege 13.5%
• CVE-2025-8428 Medium 6.8 XSS found in the HTTP loader widget 0.3%