CVE-2025-54893
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Hosts templates configuration modules) allows Stored XSS by users with elevated privileges. This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28.
Risk Assessment
The risk involves the possibility of injecting malicious scripts by privileged users, which may lead to takeover of host templates or unauthorized changes.
Recommendation
It is recommended to update Centreon Infra Monitoring to versions 24.10.13, 24.04.18, or 23.10.28 (or later) and restrict user privileges.
Other vulnerabilities in Centreon Infra Monitoring
See all- CVE-2025-15029Critical
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon Infra Monitoring (Awie export modules) allows SQL Injection to unauthenticated user. This issue affects Infra Monitoring: from 25.10.0 before 25.10.2, from 24.10.0 before 24.10.3, from 24.04.0 before 24.04.3.
- CVE-2025-15026Critical
Missing Authentication for Critical Function vulnerability in Centreon Infra Monitoring centreon-awie (Awie import module) allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Infra Monitoring: from 25.10.0 before 25.10.2, from 24.10.0 before 24.10.3, from 24.04.0 before 24.04.3.
- CVE-2025-5965High
In the backup parameters of Centreon Infra Monitoring, a user with high privileges can concatenate custom instructions to the backup setup. Improper neutralization of special elements used in an OS command allows OS Command Injection. This affects versions from 25.10.0 before 25.10.2, from 24.10.0 before 24.10.15, and from 24.04.0 before 24.04.19.
- CVE-2025-5946High
OS Command Injection vulnerability in Centreon Infra Monitoring (Poller reload setup in the configuration modules). On the poller parameters page, a user with high privilege can concatenate custom instructions into the poller reload command.
- CVE-2025-10023Medium
Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in Centreon Infra Monitoring (Services Meta-services modules) allows Stored XSS by users with elevated privileges. This issue affects Infra Monitoring: from 24.10.0 before 24.10.9, from 24.04.0 before 24.04.16, from 23.10.0 before 23.10.26.
- CVE-2025-8459High
Stored XSS vulnerability in Centreon Infra Monitoring (recurrent downtime scheduler modules). Affects versions from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28 due to improper input neutralization.
- CVE-2025-8430Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Commands Connectors configuration modules) allows Stored XSS by users with elevated privileges. This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28.
- CVE-2025-8429Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (ACL Action access configuration modules) allows Stored XSS by users with elevated privileges. This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28.
- CVE-2025-8428Medium
Stored XSS vulnerability in Centreon Infra Monitoring (HTTP Loader widget modules) due to improper input neutralization during web page generation. Affects versions from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28.
- CVE-2025-54892Medium
A Stored XSS vulnerability in Centreon Infra Monitoring (SNMP traps group configuration modules) allows users with elevated privileges to inject malicious scripts. Affects versions from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, and from 23.10.0 before 23.10.28.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Hosts templates configuration modules) allows Stored XSS by users with elevated privileges. This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS