Blind SQL Injection

A SQL Injection vulnerability exists in the updateServiceHost functionality in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and 22.10.x…

Multiple SQL injection vulnerabilities in Centreon 3.4.6 including Centreon Web 2.8.23 allow attacks via the searchU parameter in viewLogs.php, the id parameter in GetXmlHost.php,…

There is Remote Code Execution in Centreon 3.4.6 including Centreon Web 2.8.23 via the RPN value in the Virtual Metric form in centreonGraph.class.php

Centreon sysName Cross-Site Scripting Remote Code Execution Vulnerability

A SQL Injection vulnerability exists in the Timeperiod component in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and 22.10.x before…

A SQL Injection vulnerability exists in the Graph Template component in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and 22.10.x before…

A SQL Injection vulnerability exists in the Downtime component in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and 22.10.x before…

Second order SQL injection available to user with low privilege

A SQL Injection vulnerability exists in the service configuration functionality in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and…

Centreon initCurveList SQL Injection Remote Code Execution Vulnerability

Centreon updateServiceHost SQL Injection Remote Code Execution Vulnerability

Centreon insertGraphTemplate SQL Injection Remote Code Execution Vulnerability

Centreon updateDirectory SQL Injection Remote Code Execution Vulnerability

An issue was discovered in Centreon Web through 19.04.3

A problem was found in Centreon Web through 19.04.3

A problem was found in Centreon Web through 19.04.3

minPlayCommand.php in Centreon Web before 2.8.27 allows authenticated attackers to execute arbitrary code via the command_hostaddress parameter

getStats.php in Centreon Web before 2.8.28 allows authenticated attackers to execute arbitrary code via the ns_id parameter

makeXML_ListServices.php in Centreon Web before 2.8.28 allows attackers to perform SQL injections via the host_id parameter

img_gantt.php in Centreon Web before 2.8.27 allows attackers to perform SQL injections via the host_id parameter

Centreon Web 19.04.4 has weak permissions within the OVA (aka VMware virtual machine) and OVF (aka VirtualBox virtual machine) files, allowing attackers to gain privileges via a…

In very rare cases, a PHP type juggling vulnerability in centreonAuth.class.php in Centreon Web before 2.8.27 allows attackers to bypass authentication mechanisms in place

RCE via the backup feature available only to user with high privilege

RCE via the poller reload feature available only to user with high privilege

User with high privileges is able to introduce a SQLi using the Meta Service indicator page

A high privilege user is able to create and use a valid admin API token in centreon-web

Privilege escalation by altering payload in contact form

An issue was discovered in Centreon Web 24.10.x before 24.10.3, 24.04.x before 24.04.9, 23.10.x before 23.10.19, 23.04.x before 23.04.24

An issue was discovered in Centreon centreon-web 24.10.x before 24.10.3, 24.04.x before 24.04.9, 23.10.x before 23.10.19, 23.04.x before 23.04.24

Centreon updateContactHostCommands SQL Injection Remote Code Execution Vulnerability

Centreon updateContactServiceCommands SQL Injection Remote Code Execution Vulnerability

Centreon updateLCARelation SQL Injection Remote Code Execution Vulnerability

Centreon updateGroups SQL Injection Remote Code Execution Vulnerability

Centreon Web before 2.8.30, 18.10.x before 18.10.8, 19.04.x before 19.04.5 and 19.10.x before 19.10.2 allows Remote Code Execution by an administrator who can modify Macro…

Insecure Permissions in Centreon Web versions 19.10.18, 20.04.8, and 20.10.2 allows remote attackers to bypass validation by changing any file extension to ".gif", then uploading…

In Centreon Web through 2.8.29, disclosure of external components' passwords allows authenticated attackers to move laterally to external components

Local file inclusion in brokerPerformance.php in Centreon Web before 2.8.28 allows attackers to disclose information or perform a stored XSS attack on a user

A user with elevated privileges can inject XSS by altering the content of a SVG media during the submit request.

A user with low privileges can inject XSS in the Monitoring Recurrent downtimes page

XSS found in the HTTP loader widget

Centreon 3.4.6 including Centreon Web 2.8.23 is vulnerable to an authenticated user injecting a payload into the username or command description, resulting in stored XSS

Information disclosure on Administration parameters API endpoint

The token generator in index.php in Centreon Web before 2.8.27 is predictable

ACL are not correctly taken into account in the display of the "event logs" page. This page requiring, high privileges, will display all available logs.

A user with elevated privileges can inject XSS in the Hosts configuration parameters page

A user with elevated privileges can inject XSS in the Administration ACL Menus configuration page

A user with elevated privileges can inject XSS in the Hostgroups configuration page

A user with elevated privileges can inject XSS in the Services Meta-services configuration page

A user with elevated privileges can inject XSS in the Commands Connectors configuration configuration page