# Centreon Infra Monitoring. Every CVE that names Centreon Infra Monitoring among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [A user with low privileges can inject SSTI templates that can lead to RCE in open-tickets](https://agentprime.io/advisories/CVE-2026-14453.md) `CVE-2026-14453` · CVE record: Centreon Infra Monitoring · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Jul 2026 · Tags: Code injection - [An unauthenticated user is able to introduce SQL Injection using the Awie export module](https://agentprime.io/advisories/CVE-2025-15029.md) `CVE-2025-15029` · CVE record: Centreon Infra Monitoring · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.13 · Not analysed yet · Published 5 Jan 2026 · Tags: SQL injection - [Unauthenticated configuration import allows administrative account creation using AWIE component](https://agentprime.io/advisories/CVE-2025-15026.md) `CVE-2025-15026` · CVE record: Centreon Infra Monitoring · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Jan 2026 · Tags: Authentication bypass - [A user with elevated privileges can inject XSS in the DSM Administration’s Extensions configuration page](https://agentprime.io/advisories/CVE-2025-12511.md) `CVE-2025-12511` · CVE record: Centreon Infra Monitoring · CVSS 6.8 Medium · Not analysed yet · Published 5 Jan 2026 · Tags: Cross-site scripting (XSS) - [A user with elevated privileges can inject XSS in the Hosts configuration parameters page](https://agentprime.io/advisories/CVE-2025-12513.md) `CVE-2025-12513` · CVE record: Centreon Infra Monitoring · CVSS 6.8 Medium · Not analysed yet · Published 5 Jan 2026 · Tags: Cross-site scripting (XSS) - [Information disclosure on Administration parameters API endpoint](https://agentprime.io/advisories/CVE-2025-12519.md) `CVE-2025-12519` · CVE record: Centreon Infra Monitoring · CVSS 5.3 Medium · Not analysed yet · Published 5 Jan 2026 · Tags: Broken access control - [A user with elevated privileges can inject XSS in the Administration ACL Menus configuration page](https://agentprime.io/advisories/CVE-2025-13056.md) `CVE-2025-13056` · CVE record: Centreon Infra Monitoring · CVSS 6.8 Medium · Not analysed yet · Published 5 Jan 2026 · Tags: Cross-site scripting (XSS) - [RCE via the backup feature available only to user with high privilege](https://agentprime.io/advisories/CVE-2025-5965.md) `CVE-2025-5965` · CVE record: Centreon Infra Monitoring · CVSS 7.2 High · Critical (CVSS 7+ and EPSS) · EPSS 0.28 · Not analysed yet · Published 5 Jan 2026 · Tags: Command injection - [A user with elevated privileges can inject XSS in the Hostgroups configuration page](https://agentprime.io/advisories/CVE-2025-54890.md) `CVE-2025-54890` · CVE record: Centreon Infra Monitoring · CVSS 6.8 Medium · Not analysed yet · Published 22 Dec 2025 · Tags: Cross-site scripting (XSS) - [A user with elevated privileges can inject XSS in the Notification rules configuration page](https://agentprime.io/advisories/CVE-2025-8460.md) `CVE-2025-8460` · CVE record: Centreon Infra Monitoring · CVSS 6.8 Medium · Not analysed yet · Published 22 Dec 2025 · Tags: Cross-site scripting (XSS) - [A user with elevated privileges can inject XSS in the Services Meta-services configuration page](https://agentprime.io/advisories/CVE-2025-10023.md) `CVE-2025-10023` · CVE record: Centreon Infra Monitoring · CVSS 6.2 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: Cross-site scripting (XSS) - [CentreonBI user account on the MBI server can execute commands as root by modifying script runned by the CRON](https://agentprime.io/advisories/CVE-2025-8432.md) `CVE-2025-8432` · CVE record: Centreon Infra Monitoring · CVSS 8.4 High · Not analysed yet · Published 27 Oct 2025 · Tags: Broken access control - [A user with low privileges can inject XSS in the Monitoring Recurrent downtimes page](https://agentprime.io/advisories/CVE-2025-8459.md) `CVE-2025-8459` · CVE record: Centreon Infra Monitoring · CVSS 7.7 High · Not analysed yet · Published 14 Oct 2025 · Tags: Cross-site scripting (XSS) - [A user with elevated privileges can inject XSS in the Commands Connectors configuration configuration page](https://agentprime.io/advisories/CVE-2025-8430.md) `CVE-2025-8430` · CVE record: Centreon Infra Monitoring · CVSS 6.8 Medium · Not analysed yet · Published 14 Oct 2025 · Tags: Cross-site scripting (XSS) - [A user with elevated privileges can inject XSS in the ACL Action access configuration page](https://agentprime.io/advisories/CVE-2025-8429.md) `CVE-2025-8429` · CVE record: Centreon Infra Monitoring · CVSS 6.8 Medium · Not analysed yet · Published 14 Oct 2025 · Tags: Cross-site scripting (XSS) - [A user with elevated privileges can inject XSS in the Hosts templates configuration page](https://agentprime.io/advisories/CVE-2025-54893.md) `CVE-2025-54893` · CVE record: Centreon Infra Monitoring · CVSS 6.8 Medium · Not analysed yet · Published 14 Oct 2025 · Tags: Cross-site scripting (XSS) - [A user with elevated privileges can inject XSS in the ACL Resource Access configuration page](https://agentprime.io/advisories/CVE-2025-54891.md) `CVE-2025-54891` · CVE record: Centreon Infra Monitoring · CVSS 6.8 Medium · Not analysed yet · Published 14 Oct 2025 · Tags: Cross-site scripting (XSS) - [A user with elevated privileges can inject XSS in the SNMP traps group configuration page](https://agentprime.io/advisories/CVE-2025-54892.md) `CVE-2025-54892` · CVE record: Centreon Infra Monitoring · CVSS 6.8 Medium · Not analysed yet · Published 14 Oct 2025 · Tags: Cross-site scripting (XSS) - [A user with elevated privileges can inject XSS in the SNMP traps manufacturer configuration page](https://agentprime.io/advisories/CVE-2025-54889.md) `CVE-2025-54889` · CVE record: Centreon Infra Monitoring · CVSS 6.8 Medium · Not analysed yet · Published 14 Oct 2025 · Tags: Cross-site scripting (XSS) - [RCE via the poller reload feature available only to user with high privilege](https://agentprime.io/advisories/CVE-2025-5946.md) `CVE-2025-5946` · CVE record: Centreon Infra Monitoring · CVSS 7.2 High · Critical (CVSS 7+ and EPSS) · EPSS 0.14 · Not analysed yet · Published 14 Oct 2025 · Tags: Command injection - [XSS found in the HTTP loader widget](https://agentprime.io/advisories/CVE-2025-8428.md) `CVE-2025-8428` · CVE record: Centreon Infra Monitoring · CVSS 6.8 Medium · Not analysed yet · Published 14 Oct 2025 · Tags: Cross-site scripting (XSS) ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .