---
title: "Centreon web vulnerabilities and CVEs"
url: https://radicalnotion.ai/vendor/centreon/centreon-web
type: product
description: "Centreon web has 57 published CVEs, 0 in CISA KEV and 6 with public exploits."
updated: 2026-02-27
source: RadicalNotion.AI
license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/)
---

# Centreon web vulnerabilities

Vendor: [Centreon](https://radicalnotion.ai/vendor/centreon)

- **Published CVEs:** 57
- **In CISA KEV:** 0
- **With a public exploit:** 6
- **With a patch:** 55
- **Average CVSS:** 7.7
- **First CVE:** 2012-12-19
- **Latest CVE:** 2026-02-27

## Severity breakdown

| Severity | CVEs |
| --- | --- |
| Critical | 10 |
| High | 28 |
| Medium | 19 |
| Low | 0 |
| Unscored | 0 |

## Most common weakness types

| CWE | Name | CVEs |
| --- | --- | --- |
| [CWE-89](https://radicalnotion.ai/cwe/cwe-89) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 24 |
| [CWE-79](https://radicalnotion.ai/cwe/cwe-79) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 16 |
| [CWE-78](https://radicalnotion.ai/cwe/cwe-78) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | 4 |
| [CWE-94](https://radicalnotion.ai/cwe/cwe-94) | Improper Control of Generation of Code ('Code Injection') | 2 |
| [CWE-330](https://radicalnotion.ai/cwe/cwe-330) | Use of Insufficiently Random Values | 1 |
| [CWE-434](https://radicalnotion.ai/cwe/cwe-434) | Unrestricted Upload of File with Dangerous Type | 1 |
| [CWE-732](https://radicalnotion.ai/cwe/cwe-732) | Incorrect Permission Assignment for Critical Resource | 1 |
| [CWE-20](https://radicalnotion.ai/cwe/cwe-20) | Improper Input Validation | 1 |

## CVEs by year

| Year | CVEs published |
| --- | --- |
| 2018 | 3 |
| 2019 | 12 |
| 2020 | 1 |
| 2021 | 1 |
| 2022 | 0 |
| 2023 | 0 |
| 2024 | 14 |
| 2025 | 20 |
| 2026 | 5 |

## Affected versions (top 24 of 120)

| Version | Kind | CVEs |
| --- | --- | --- |
| 23.10.0 \<= v \< 23.10.28 | range | 9 |
| 24.04.0 \<= v \< 24.04.18 | range | 9 |
| 24.10.0 \<= v \< 24.10.13 | range | 9 |
| \< 22.04.19 | range | 6 |
| 22.10.2 \<= v \< 22.10.17 | range | 6 |
| 23.04.0 \<= v \< 23.04.13 | range | 6 |
| 23.04.0 \<= v \< 23.04.19 | range | 6 |
| 23.10.0 \<= v \< 23.10.13 | range | 6 |
| 23.10.0 \<= v \< 23.10.5 | range | 6 |
| 24.04.0 \<= v \< 24.04.3 | range | 6 |
| 22.10.0 \<= v \< 22.10.23 | range | 5 |
| 24.04.0 \<= v \< 24.04.19 | range | 5 |
| 23.10.28 | patched | 9 |
| 24.04.18 | patched | 9 |
| 24.10.13 | patched | 9 |
| 22.04.19 | patched | 6 |
| 22.10.17 | patched | 6 |
| 22.10.23 | patched | 6 |
| 23.04.13 | patched | 6 |
| 23.04.19 | patched | 6 |
| 23.10.13 | patched | 6 |
| 23.10.5 | patched | 6 |
| 24.04.3 | patched | 6 |
| 24.04.19 | patched | 5 |

## CVEs (first 30 of 57, most severe first)

| CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch |
| --- | --- | --- | --- | --- | --- | --- |
| CVE-2026-2751 | Blind SQL Injection | critical | 9.8 | No | No | Yes |
| CVE-2025-12513 | A user with elevated privileges can inject XSS in the Hosts configuration parameters page | medium | 6.8 | No | No | Yes |
| CVE-2025-12519 | Information disclosure on Administration parameters API endpoint | medium | 5.3 | No | No | Yes |
| CVE-2025-13056 | A user with elevated privileges can inject XSS in the Administration ACL Menus configuration page | medium | 6.8 | No | No | Yes |
| CVE-2025-5965 | RCE via the backup feature available only to user with high privilege | high | 7.2 | No | No | Yes |
| CVE-2025-54890 | A user with elevated privileges can inject XSS in the Hostgroups configuration page | medium | 6.8 | No | No | Yes |
| CVE-2025-10023 | A user with elevated privileges can inject XSS in the Services Meta-services configuration page | medium | 6.2 | No | No | Yes |
| CVE-2025-8459 | A user with low privileges can inject XSS in the Monitoring Recurrent downtimes page | high | 7.7 | No | No | Yes |
| CVE-2025-8430 | A user with elevated privileges can inject XSS in the Commands Connectors configuration configuration page | medium | 6.8 | No | No | Yes |
| CVE-2025-8429 | A user with elevated privileges can inject XSS in the ACL Action access configuration page | medium | 6.8 | No | No | Yes |
| CVE-2025-54893 | A user with elevated privileges can inject XSS in the Hosts templates configuration page | medium | 6.8 | No | No | Yes |
| CVE-2025-54891 | A user with elevated privileges can inject XSS in the ACL Resource Access configuration page | medium | 6.8 | No | No | Yes |
| CVE-2025-54892 | A user with elevated privileges can inject XSS in the SNMP traps group configuration page | medium | 6.8 | No | No | Yes |
| CVE-2025-54889 | A user with elevated privileges can inject XSS in the SNMP traps manufacturer configuration page | medium | 6.8 | No | No | Yes |
| CVE-2025-5946 | RCE via the poller reload feature available only to user with high privilege | high | 7.2 | No | Yes | Yes |
| CVE-2025-8428 | XSS found in the HTTP loader widget | medium | 6.8 | No | No | Yes |
| CVE-2025-6791 | Second order SQL injection available to user with low privilege | high | 8.8 | No | No | Yes |
| CVE-2025-4650 | User with high privileges is able to introduce a SQLi using the Meta Service indicator page | high | 7.2 | No | No | Yes |
| CVE-2025-4649 | ACL are not correctly taken into account in the display of the "event logs" page. This page requiring, high privileges, will display all available logs. | medium | 4.9 | No | No | Yes |
| CVE-2025-4648 | A user with elevated privileges can inject XSS by altering the content of a SVG media during the submit request. | high | 8.4 | No | No | Yes |
| CVE-2025-4647 | A user with elevated privileges can bypass sanitization measures by replacing the content of an existing SVG | high | 8.4 | No | No | Yes |
| CVE-2025-4646 | A high privilege user is able to create and use a valid admin API token in centreon-web | high | 7.2 | No | No | Yes |
| CVE-2025-3872 | Privilege escalation by altering payload in contact form | high | 7.2 | No | No | Yes |
| CVE-2024-55573 | - | critical | 9.1 | No | No | Yes |
| CVE-2024-53923 | - | critical | 9.1 | No | No | Yes |
| CVE-2024-39841 | - | high | 8.8 | No | No | Yes |
| CVE-2024-33854 | - | critical | 9.1 | No | No | Yes |
| CVE-2024-33853 | - | critical | 9.1 | No | No | Yes |
| CVE-2024-33852 | - | critical | 9.1 | No | No | Yes |
| CVE-2024-32501 | - | critical | 9.8 | No | No | Yes |

## Frequently asked questions

### How many CVEs does Centreon web have?

Centreon web has 57 published CVE records since 2012.

### How many Centreon web CVEs are in CISA KEV?

None of Centreon web's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

### Are there public exploits for Centreon web vulnerabilities?

Yes — 6 of Centreon web's CVEs have a known public exploit.

### Which versions of Centreon web are affected?

120 distinct Centreon web versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

### What are the most common weakness types in Centreon web CVEs?

Centreon web's CVEs most often map to these CWE weakness types: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')), CWE-94 (Improper Control of Generation of Code ('Code Injection')).

### How many critical Centreon web vulnerabilities are there?

Centreon web has 10 critical and 28 high-severity CVEs.

### What is the average severity of Centreon web CVEs?

The average CVSS base score across Centreon web's scored CVEs is 7.7.

## Other products from this vendor

- [Centreon](https://radicalnotion.ai/vendor/centreon/centreon) (128 CVEs)
- [centreon/centreon](https://radicalnotion.ai/vendor/centreon/centreon-centreon) (27 CVEs)
- [Infra Monitoring](https://radicalnotion.ai/vendor/centreon/infra-monitoring) (21 CVEs)
- [centreon-archived](https://radicalnotion.ai/vendor/centreon/centreon-archived) (10 CVEs)
- [web](https://radicalnotion.ai/vendor/centreon/web) (7 CVEs)
- [centreon host-monitoring widget](https://radicalnotion.ai/vendor/centreon/centreon-host-monitoring-widget) (3 CVEs)
- [centreon service-monitoring widget](https://radicalnotion.ai/vendor/centreon/centreon-service-monitoring-widget) (3 CVEs)
- [centreon tactical-overview widget](https://radicalnotion.ai/vendor/centreon/centreon-tactical-overview-widget) (3 CVEs)

---

Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/centreon/centreon-web). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.