Centreon Infra Monitoring vulnerabilities

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon Infra Monitoring (Awie export modules) allows SQL Injection to unauthenticated user. This issue affects Infra Monitoring: from 25.10.0 before 25.10.2, from 24.10.0 before 24.10.3, from 24.04.0 before 24.04.3.

Missing Authentication for Critical Function vulnerability in Centreon Infra Monitoring centreon-awie (Awie import module) allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Infra Monitoring: from 25.10.0 before 25.10.2, from 24.10.0 before 24.10.3, from 24.04.0 before 24.04.3.

In the backup parameters of Centreon Infra Monitoring, a user with high privileges can concatenate custom instructions to the backup setup. Improper neutralization of special elements used in an OS command allows OS Command Injection. This affects versions from 25.10.0 before 25.10.2, from 24.10.0 before 24.10.15, and from 24.04.0 before 24.04.19.

OS Command Injection vulnerability in Centreon Infra Monitoring (Poller reload setup in the configuration modules). On the poller parameters page, a user with high privilege can concatenate custom instructions into the poller reload command.

Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in Centreon Infra Monitoring (Services Meta-services modules) allows Stored XSS by users with elevated privileges. This issue affects Infra Monitoring: from 24.10.0 before 24.10.9, from 24.04.0 before 24.04.16, from 23.10.0 before 23.10.26.

Stored XSS vulnerability in Centreon Infra Monitoring (recurrent downtime scheduler modules). Affects versions from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28 due to improper input neutralization.

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Commands Connectors configuration modules) allows Stored XSS by users with elevated privileges. This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28.

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (ACL Action access configuration modules) allows Stored XSS by users with elevated privileges. This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28.

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Hosts templates configuration modules) allows Stored XSS by users with elevated privileges. This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28.

Stored XSS vulnerability in Centreon Infra Monitoring (HTTP Loader widget modules) due to improper input neutralization during web page generation. Affects versions from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28.

A Stored XSS vulnerability in Centreon Infra Monitoring (SNMP traps group configuration modules) allows users with elevated privileges to inject malicious scripts. Affects versions from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, and from 23.10.0 before 23.10.28.

A Stored Cross-site Scripting (XSS) vulnerability in Centreon Infra Monitoring arises from improper neutralization of input during web page generation. Users with elevated privileges can inject malicious scripts in the ACL Resource access configuration modules. This affects versions from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, and from 23.10.0 before 23.10.28.

A Stored Cross-site Scripting (XSS) vulnerability in Centreon Infra Monitoring is caused by improper neutralization of input during web page generation. Users with elevated privileges can inject malicious scripts in the SNMP traps manufacturer configuration modules. This affects versions from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, and from 23.10.0 before 23.10.28.