CVE-2025-8459
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Stored XSS vulnerability in Centreon Infra Monitoring (recurrent downtime scheduler modules). Affects versions from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28 due to improper input neutralization.
Risk Assessment
An attacker can persistently inject malicious script that executes in other users' browsers, potentially leading to session theft or account takeover.
Recommendation
Upgrade Centreon Infra Monitoring to versions 24.10.13, 24.04.18, or 23.10.28 (or later).
Other vulnerabilities in Centreon Infra Monitoring
See all- CVE-2025-15029Critical
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon Infra Monitoring (Awie export modules) allows SQL Injection to unauthenticated user. This issue affects Infra Monitoring: from 25.10.0 before 25.10.2, from 24.10.0 before 24.10.3, from 24.04.0 before 24.04.3.
- CVE-2025-15026Critical
Missing Authentication for Critical Function vulnerability in Centreon Infra Monitoring centreon-awie (Awie import module) allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Infra Monitoring: from 25.10.0 before 25.10.2, from 24.10.0 before 24.10.3, from 24.04.0 before 24.04.3.
- CVE-2025-5965High
In the backup parameters of Centreon Infra Monitoring, a user with high privileges can concatenate custom instructions to the backup setup. Improper neutralization of special elements used in an OS command allows OS Command Injection. This affects versions from 25.10.0 before 25.10.2, from 24.10.0 before 24.10.15, and from 24.04.0 before 24.04.19.
- CVE-2025-5946High
OS Command Injection vulnerability in Centreon Infra Monitoring (Poller reload setup in the configuration modules). On the poller parameters page, a user with high privilege can concatenate custom instructions into the poller reload command.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Monitoring recurrent downtime scheduler modules) allows Stored XSS.This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS