CVE-2025-4650

HIGH

Centreon Web 23.10.0-23.10.25 - Authenticated SQL Injection via Meta Service Indicator Page

Title source: llm

Description

User with high privileges is able to introduce a SQLi using the Meta Service indicator page. Caused by an Improper Neutralization of Special Elements used in an SQL Command.This issue affects web: from 24.10.0 before 24.10.9, from 24.04.0 before 24.04.16, from 23.10.0 before 23.10.26.

References (2)

Core 2

Core References

Release Notes release-notes

https://github.com/centreon/centreon/releases

Vendor Advisory vendor-advisory

https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-4650-centreon-web-all-versions-high-severity-4901

Scores

CVSS v3 7.2

EPSS 0.0038

EPSS Percentile 30.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-89

Status published

Products (1)

centreon/centreon_web 23.10.0 - 23.10.26

Published Aug 22, 2025

Tracked Since Feb 18, 2026