Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-3872

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon centreon-web (User configuration form modules) allows SQL Injection. A user with high privileges is able to become administrator by intercepting the contact form request and altering its payload. This issue affects Centreon: from 22.10.0 before 22.10.28, from 23.04.0 before 23.04.25, from 23.10.0 before 23.10.20, from 24.04.0 before 24.04.10, from 24.10.0 before 24.10.4.

Published

2025-04-24T10:15:17.093

Last Modified

2025-10-22T14:10:02.373

Status

Analyzed

Source

bd4443e6-1eef-43f3-9886-25fc9ceeaae7

Severity

CVSSv3.1: 7.2 (HIGH)

Weaknesses

Type: Secondary
CWE-89

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	centreon	centreon_web	< 22.10.28	Yes
Application	centreon	centreon_web	< 23.04.25	Yes
Application	centreon	centreon_web	< 23.10.20	Yes
Application	centreon	centreon_web	< 24.04.10	Yes
Application	centreon	centreon_web	< 24.10.4	Yes

References

https://github.com/centreon/centreon/releases Release Notes (bd4443e6-1eef-43f3-9886-25fc9ceeaae7)
https://thewatch.centreon.com/latest-security-bulletins-64/cve-2024-55571-centreon-web-high-severity-4496 Vendor Advisory (bd4443e6-1eef-43f3-9886-25fc9ceeaae7)