WE
Product
web
7
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 3Medium 3Low 0
Watch
Add web to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-2750 | 9.8 | Feb 27 | Command Injection via CLAPI generatetraps Affected: before 24.04.24; 24.10.0 before 24.10.20; 25.01.0 before 25.10.8 |
| CVE-2025-6791 | 8.8 | Aug 22 | Second order SQL injection available to user with low privilege Affected: 24.10.0 before 24.10.9; 24.04.0 before 24.04.16; 23.10.0 before 23.10.26 |
| CVE-2025-4650 | 7.2 | Aug 22 | User with high privileges is able to introduce a SQLi using the Meta Service indicator page Affected: 24.10.0 before 24.10.9; 24.04.0 before 24.04.16; 23.10.0 before 23.10.26 |
| CVE-2025-4646 | 7.2 | May 13 | A high privilege user is able to create and use a valid admin API token in centreon-web Affected: 24.04.0 before 24.04.10; 24.10.0 before 24.10.4 |
| CVE-2025-4648 | 5.9 | May 13 | A user with elevated privileges can inject XSS by altering the content of a SVG media during the submit request. Affected: 24.10.0 before 24.10.5; 24.04.0 before 24.04.11; 23.10.0 before 23.10.22; 23.04.0 before 23.04.27; 22.10.0 before 22.10.29 |
| CVE-2025-4649 | 4.9 | May 13 | ACL are not correctly taken into account in the display of the "event logs" page. This page requiring, high privileges, will display all available logs. Affected: 24.10.3 before 24.10.4; 24.04.09 before 24.04.10; 23.10.19 before 23.10.21; 23.04.24 before 23.04.26 |
| CVE-2025-4647 | 4.8 | May 13 | A user with elevated privileges can bypass sanitization measures by replacing the content of an existing SVG Affected: 24.10.0 before 24.10.5; 24.04.0 before 24.04.11; 23.10.0 before 23.10.22; 23.04.0 before 23.04.27; 22.10.0 before 22.10.29 |
Showing 7