CW
Product
Centreon Web
56
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 8High 27Medium 21Low 0
Watch
Add Centreon Web to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-26804 | 6.5 | May 4 | Insecure Permissions in Centreon Web versions 19.10.18, 20.04.8, and 20.10.2 allows remote attackers to bypass validation by changing any file extension to ".gif", then uploading… Affected: 19.10.18; 20.04.8; 20.10.2 |
| CVE-2019-17106 | 6.5 | Oct 8 | In Centreon Web through 2.8.29, disclosure of external components' passwords allows authenticated attackers to move laterally to external components Affected: through 2.8.29 |
| CVE-2019-17108 | 6.1 | Oct 8 | Local file inclusion in brokerPerformance.php in Centreon Web before 2.8.28 allows attackers to disclose information or perform a stored XSS attack on a user Affected: 2.8 before 2.8.28; 18.10.0 before 18.10.5 |
| CVE-2025-4648 | 5.9 | May 13 | A user with elevated privileges can inject XSS by altering the content of a SVG media during the submit request. Affected: 22.10.0 before 22.10.29; 23.04.0 before 23.04.27; 23.10.0 before 23.10.22; 24.04.0 before 24.04.11; 24.10.0 before 24.10.5 |
| CVE-2025-8459 | 5.4 | Oct 14 | A user with low privileges can inject XSS in the Monitoring Recurrent downtimes page Affected: 23.10.0 before 23.10.28; 24.04.0 before 24.04.18; 24.10.0 before 24.10.13 |
| CVE-2025-8428 | 5.4 | Oct 14 | XSS found in the HTTP loader widget Affected: 23.10.0 before 23.10.28; 24.04.0 before 24.04.18; 24.10.0 before 24.10.13 |
| CVE-2018-11588 | 5.4 | Jun 25 | Centreon 3.4.6 including Centreon Web 2.8.23 is vulnerable to an authenticated user injecting a payload into the username or command description, resulting in stored XSS Affected: 2.8.23 |
| CVE-2025-12519 | 5.3 | Jan 5 | Information disclosure on Administration parameters API endpoint Affected: 24.04.0 before 24.04.19; 24.10.0 before 24.10.15; 25.10.0 before 25.10.2 |
| CVE-2019-17105 | 5.3 | Oct 8 | The token generator in index.php in Centreon Web before 2.8.27 is predictable Affected: 2.8 before 2.8.27; 18.10.0 before 18.10.5 |
| CVE-2025-4649 | 4.9 | May 13 | ACL are not correctly taken into account in the display of the "event logs" page. This page requiring, high privileges, will display all available logs. Affected: 23.04.24 before 23.04.26; 23.10.19 before 23.10.21; 24.04.9; 24.10.3 |
| CVE-2025-12513 | 4.8 | Jan 5 | A user with elevated privileges can inject XSS in the Hosts configuration parameters page Affected: 24.04.0 before 24.04.19; 24.10.0 before 24.10.15; 25.10.0 before 25.10.2 |
| CVE-2025-13056 | 4.8 | Jan 5 | A user with elevated privileges can inject XSS in the Administration ACL Menus configuration page Affected: 24.04.0 before 24.04.19; 24.10.0 before 24.10.15; 25.10.0 before 25.10.2 |
| CVE-2025-54890 | 4.8 | Dec 22 | A user with elevated privileges can inject XSS in the Hostgroups configuration page Affected: 23.10.0 before 23.10.29; 24.04.0 before 24.04.19; 24.10.0 before 24.10.15 |
| CVE-2025-10023 | 4.8 | Oct 27 | A user with elevated privileges can inject XSS in the Services Meta-services configuration page Affected: 23.10.0 before 23.10.26; 24.04.0 before 24.04.16; 24.10.0 before 24.10.9 |
| CVE-2025-8430 | 4.8 | Oct 14 | A user with elevated privileges can inject XSS in the Commands Connectors configuration configuration page Affected: 23.10.0 before 23.10.28; 24.04.0 before 24.04.18; 24.10.0 before 24.10.13 |
| CVE-2025-8429 | 4.8 | Oct 14 | A user with elevated privileges can inject XSS in the ACL Action access configuration page Affected: 23.10.0 before 23.10.28; 24.04.0 before 24.04.18; 24.10.0 before 24.10.13 |
| CVE-2025-54893 | 4.8 | Oct 14 | A user with elevated privileges can inject XSS in the Hosts templates configuration page Affected: 23.10.0 before 23.10.28; 24.04.0 before 24.04.18; 24.10.0 before 24.10.13 |
| CVE-2025-54891 | 4.8 | Oct 14 | A user with elevated privileges can inject XSS in the ACL Resource Access configuration page Affected: 23.10.0 before 23.10.28; 24.04.0 before 24.04.18; 24.10.0 before 24.10.13 |
| CVE-2025-54892 | 4.8 | Oct 14 | A user with elevated privileges can inject XSS in the SNMP traps group configuration page Affected: 23.10.0 before 23.10.28; 24.04.0 before 24.04.18; 24.10.0 before 24.10.13 |
| CVE-2025-54889 | 4.8 | Oct 14 | A user with elevated privileges can inject XSS in the SNMP traps manufacturer configuration page Affected: 23.10.0 before 23.10.28; 24.04.0 before 24.04.18; 24.10.0 before 24.10.13 |
| CVE-2025-4647 | 4.8 | May 13 | A user with elevated privileges can bypass sanitization measures by replacing the content of an existing SVG Affected: 22.10.0 before 22.10.29; 23.04.0 before 23.04.27; 23.10.0 before 23.10.22; 24.04.0 before 24.04.11; 24.10.0 before 24.10.5 |
Showing 21