CVE-2025-6791

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-6791
In the monitoring event logs page, it is possible to alter the http request to insert a reflect payload in the DB. Caused by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon web (Monitoring event logs modules) allows SQL Injection.This issue affects web: 24.10.0, 24.04.0, 23.10.0.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/centreon/centreon/releases Release Notes
https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-6791-centreon-web-all-versions-high-severity-4900 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:*
cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:*
cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:*
History

22 Oct 2025, 14:06

Type Values Removed Values Added
First Time Centreon
Centreon centreon Web
CPE cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:*
References () https://github.com/centreon/centreon/releases - () https://github.com/centreon/centreon/releases - Release Notes
References () https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-6791-centreon-web-all-versions-high-severity-4900 - () https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-6791-centreon-web-all-versions-high-severity-4900 - Vendor Advisory

16 Sep 2025, 20:15

Type Values Removed Values Added
Summary (en) On the monitoring event logs page, it is possible to alter the http request to insert a payload in the DB. Caused by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon web (Monitoring event logs modules) allows SQL Injection. This issue affects web: from 24.10.0 before 24.10.9, from 24.04.0 before 24.04.16, from 23.10.0 before 23.10.26. (en) In the monitoring event logs page, it is possible to alter the http request to insert a reflect payload in the DB. Caused by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon web (Monitoring event logs modules) allows SQL Injection.This issue affects web: 24.10.0, 24.04.0, 23.10.0.

25 Aug 2025, 20:24

Type Values Removed Values Added
Summary
  • (es) En la página de monitoreo de registros de eventos, es posible modificar la solicitud HTTP para insertar un payload en la base de datos. Esto se debe a una vulnerabilidad de neutralización incorrecta de elementos especiales utilizados en un comando SQL ('Inyección SQL') en la web de Centreon (módulos de monitoreo de registros de eventos) que permite la inyección SQL. Este problema afecta a la web: desde la versión 24.10.0 hasta la 24.10.9, desde la versión 24.04.0 hasta la 24.04.16, desde la versión 23.10.0 hasta la 23.10.26.

22 Aug 2025, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-22 19:15

Updated : 2025-10-22 14:06

NVD link : CVE-2025-6791

Mitre link : CVE-2025-6791

CVE.ORG link : CVE-2025-6791

JSON object : View

Products Affected

centreon

  • centreon_web
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')