目標達成 すべての支援者に感謝 — 100%達成しました！

目標: 1000 CNY · 調達済み: 1000 CNY

100.0%
コーヒーを一杯おごる

Centreon 厂商漏洞列表 / CVE 中文分析 51

Centreon 厂商相关 51 条 CVE 漏洞，含 AI 中文分析、POC、CVSS 评分与受影响产品。

Centreon 是一款企业级 IT 监控解决方案，核心用于实时追踪网络、服务器及应用性能。其历史漏洞多集中于远程代码执行、跨站脚本及越权访问，常因输入验证缺失或权限配置不当引发。尽管提供集中式监控能力，但多次披露的 CVE 暴露了其在 Web 接口处理上的风险。安全团队需重点关注版本更新，及时修补已知缺陷以保障监控基础设施的稳定性与数据隐私。

上位製品 Centreon: Centreon Infra Monitoring web Centreon BAM Infra Monitoring - Open-tickets Centreon Web on Central Server Centreon Open Tickets on Central Server
CVE IDタイトルCVSS深刻度公開日
CVE-2026-2749 Path traversal in Centreon Open Tickets 9.9 Critical2026-02-27
CVE-2026-2750 Command Injection via CLAPI generatetraps — Centreon Open Tickets on Central ServerCWE-20 9.1 Critical2026-02-27
CVE-2026-2751 Blind SQL Injection — Centreon Web on Central Server 8.3 High2026-02-27
CVE-2025-15029 An unauthenticated user is able to introduce SQL Injection using the Awie export module — Infra MonitoringCWE-89 9.8 Critical2026-01-05
CVE-2025-15026 Unauthenticated configuration import allows administrative account creation using AWIE component — Infra MonitoringCWE-306 9.8 Critical2026-01-05
CVE-2025-12511 A user with elevated privileges can inject XSS in the DSM Administration’s Extensions configuration page — Infra MonitoringCWE-79 6.8 Medium2026-01-05
CVE-2025-12513 A user with elevated privileges can inject XSS in the Hosts configuration parameters page — Infra MonitoringCWE-79 6.8 Medium2026-01-05
CVE-2025-12519 Information disclosure on Administration parameters API endpoint — Infra MonitoringCWE-862 5.3 Medium2026-01-05
CVE-2025-13056 A user with elevated privileges can inject XSS in the Administration ACL Menus configuration page — Infra MonitoringCWE-79 6.8 Medium2026-01-05
CVE-2025-5965 RCE via the backup feature available only to user with high privilege — Infra MonitoringCWE-78 7.2 High2026-01-05
CVE-2025-54890 A user with elevated privileges can inject XSS in the Hostgroups configuration page — Infra MonitoringCWE-79 6.8 Medium2025-12-22
CVE-2025-12514 A user with elevated privileges is able to introduce a SQL Injection using the Open-tickets Notification rules configuration parameters — Infra Monitoring - Open-ticketsCWE-89 7.2 High2025-12-22
CVE-2025-8460 A user with elevated privileges can inject XSS in the Notification rules configuration page — Infra MonitoringCWE-79 6.8 Medium2025-12-22
CVE-2025-10023 A user with elevated privileges can inject XSS in the Services Meta-services configuration page — Infra MonitoringCWE-79 6.2 Medium2025-10-27
CVE-2025-8432 CentreonBI user account on the MBI server can execute commands as root by modifying script runned by the CRON — Infra MonitoringCWE-276 8.4 High2025-10-27
CVE-2025-8459 A user with low privileges can inject XSS in the Monitoring Recurrent downtimes page — Infra MonitoringCWE-79 7.7 High2025-10-14
CVE-2025-8430 A user with elevated privileges can inject XSS in the Commands Connectors configuration configuration page — Infra MonitoringCWE-79 6.8 Medium2025-10-14
CVE-2025-8429 A user with elevated privileges can inject XSS in the ACL Action access configuration page — Infra MonitoringCWE-79 6.8 Medium2025-10-14
CVE-2025-54893 A user with elevated privileges can inject XSS in the Hosts templates configuration page — Infra MonitoringCWE-79 6.8 Medium2025-10-14
CVE-2025-54891 A user with elevated privileges can inject XSS in the ACL Resource Access configuration page — Infra MonitoringCWE-79 6.8 Medium2025-10-14
CVE-2025-54892 A user with elevated privileges can inject XSS in the SNMP traps group configuration page — Infra MonitoringCWE-79 6.8 Medium2025-10-14
CVE-2025-54889 A user with elevated privileges can inject XSS in the SNMP traps manufacturer configuration page — Infra MonitoringCWE-79 6.8 Medium2025-10-14
CVE-2025-5946 RCE via the poller reload feature available only to user with high privilege — Infra MonitoringCWE-78 7.2 High2025-10-14
CVE-2025-8428 XSS found in the HTTP loader widget — Infra MonitoringCWE-79 6.8 Medium2025-10-14
CVE-2025-6791 Second order SQL injection available to user with low privilege — webCWE-89 8.8 High2025-08-22
CVE-2025-4650 User with high privileges is able to introduce a SQLi using the Meta Service indicator page — webCWE-89 7.2 High2025-08-22
CVE-2025-4649 ACL are not correctly taken into account in the display of the "event logs" page. This page requiring, high privileges, will display all available logs. — webCWE-755 4.9 Medium2025-05-13
CVE-2025-4648 A user with elevated privileges can inject XSS by altering the content of a SVG media during the submit request. — webCWE-434 8.4 High2025-05-13
CVE-2025-4647 A user with elevated privileges can bypass sanitization measures by replacing the content of an existing SVG — webCWE-79 8.4 High2025-05-13
CVE-2025-4646 A high privilege user is able to create and use a valid admin API token in centreon-web — webCWE-863 7.2 High2025-05-13

本页汇总了 Centreon 厂商截至目前公开的全部 51 条 CVE 漏洞。每条漏洞均包含 CVSS 评分、CWE 弱点分类、受影响产品与参考链接，并附带 AI 生成的中文分析以便快速判断风险。