--- title: "Centreon web vulnerabilities and CVEs" url: https://radicalnotion.ai/vendor/centreon/web type: product description: "Centreon web has 7 published CVEs, 0 in CISA KEV and 0 with public exploits." updated: 2026-02-27 source: RadicalNotion.AI license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/) --- # Centreon web vulnerabilities Vendor: [Centreon](https://radicalnotion.ai/vendor/centreon) - **Published CVEs:** 7 - **In CISA KEV:** 0 - **With a public exploit:** 0 - **With a patch:** 7 - **Average CVSS:** 7.8 - **First CVE:** 2025-05-13 - **Latest CVE:** 2026-02-27 ## Severity breakdown | Severity | CVEs | | --- | --- | | Critical | 1 | | High | 5 | | Medium | 1 | | Low | 0 | | Unscored | 0 | ## Most common weakness types | CWE | Name | CVEs | | --- | --- | --- | | [CWE-89](https://radicalnotion.ai/cwe/cwe-89) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 2 | | [CWE-20](https://radicalnotion.ai/cwe/cwe-20) | Improper Input Validation | 1 | | [CWE-434](https://radicalnotion.ai/cwe/cwe-434) | Unrestricted Upload of File with Dangerous Type | 1 | | [CWE-755](https://radicalnotion.ai/cwe/cwe-755) | Improper Handling of Exceptional Conditions | 1 | | [CWE-79](https://radicalnotion.ai/cwe/cwe-79) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 1 | | [CWE-863](https://radicalnotion.ai/cwe/cwe-863) | Incorrect Authorization | 1 | ## CVEs by year | Year | CVEs published | | --- | --- | | 2025 | 6 | | 2026 | 1 | ## Affected versions (top 24 of 32) | Version | Kind | CVEs | | --- | --- | --- | | 22.10.0 \<= v \< 22.10.29 | range | 2 | | 23.04.0 \<= v \< 23.04.27 | range | 2 | | 23.10.0 \<= v \< 23.10.22 | range | 2 | | 23.10.0 \<= v \< 23.10.26 | range | 2 | | 24.04.0 \<= v \< 24.04.11 | range | 2 | | 24.04.0 \<= v \< 24.04.16 | range | 2 | | 24.10.0 \<= v \< 24.10.5 | range | 2 | | 24.10.0 \<= v \< 24.10.9 | range | 2 | | \< 24.04.24 | range | 1 | | 23.04.24 \<= v \< 23.04.26 | range | 1 | | 23.10.19 \<= v \< 23.10.21 | range | 1 | | 24.04.0 \<= v \< 24.04.10 | range | 1 | | 22.10.29 | patched | 2 | | 23.04.27 | patched | 2 | | 23.10.22 | patched | 2 | | 23.10.26 | patched | 2 | | 24.04.10 | patched | 2 | | 24.04.11 | patched | 2 | | 24.04.16 | patched | 2 | | 24.10.4 | patched | 2 | | 24.10.5 | patched | 2 | | 24.10.9 | patched | 2 | | 23.04.26 | patched | 1 | | 23.10.21 | patched | 1 | ## CVEs | CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch | | --- | --- | --- | --- | --- | --- | --- | | CVE-2026-2750 | Command Injection via CLAPI generatetraps | critical | 9.8 | No | No | Yes | | CVE-2025-6791 | Second order SQL injection available to user with low privilege | high | 8.8 | No | No | Yes | | CVE-2025-4650 | User with high privileges is able to introduce a SQLi using the Meta Service indicator page | high | 7.2 | No | No | Yes | | CVE-2025-4649 | ACL are not correctly taken into account in the display of the "event logs" page. This page requiring, high privileges, will display all available logs. | medium | 4.9 | No | No | Yes | | CVE-2025-4648 | A user with elevated privileges can inject XSS by altering the content of a SVG media during the submit request. | high | 8.4 | No | No | Yes | | CVE-2025-4647 | A user with elevated privileges can bypass sanitization measures by replacing the content of an existing SVG | high | 8.4 | No | No | Yes | | CVE-2025-4646 | A high privilege user is able to create and use a valid admin API token in centreon-web | high | 7.2 | No | No | Yes | ## Frequently asked questions ### How many CVEs does Centreon web have? Centreon web has 7 published CVE records since 2025. ### How many Centreon web CVEs are in CISA KEV? None of Centreon web's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog. ### Are there public exploits for Centreon web vulnerabilities? No Centreon web CVEs currently have a tracked public exploit in this dataset. ### Which versions of Centreon web are affected? 32 distinct Centreon web versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version. ### What are the most common weakness types in Centreon web CVEs? Centreon web's CVEs most often map to these CWE weakness types: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')), CWE-20 (Improper Input Validation), CWE-434 (Unrestricted Upload of File with Dangerous Type), CWE-755 (Improper Handling of Exceptional Conditions). ### How many critical Centreon web vulnerabilities are there? Centreon web has 1 critical and 5 high-severity CVEs. ### What is the average severity of Centreon web CVEs? The average CVSS base score across Centreon web's scored CVEs is 7.8. ## Other products from this vendor - [Centreon](https://radicalnotion.ai/vendor/centreon/centreon) (128 CVEs) - [Centreon web](https://radicalnotion.ai/vendor/centreon/centreon-web) (57 CVEs) - [centreon/centreon](https://radicalnotion.ai/vendor/centreon/centreon-centreon) (27 CVEs) - [Infra Monitoring](https://radicalnotion.ai/vendor/centreon/infra-monitoring) (21 CVEs) - [centreon-archived](https://radicalnotion.ai/vendor/centreon/centreon-archived) (10 CVEs) - [centreon host-monitoring widget](https://radicalnotion.ai/vendor/centreon/centreon-host-monitoring-widget) (3 CVEs) - [centreon service-monitoring widget](https://radicalnotion.ai/vendor/centreon/centreon-service-monitoring-widget) (3 CVEs) - [centreon tactical-overview widget](https://radicalnotion.ai/vendor/centreon/centreon-tactical-overview-widget) (3 CVEs) --- Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/centreon/web). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.