by Kastro
Paper/Archive/CVE-2025-15029

CVE-2025-15029

Centreon Infra Monitoring — An unauthenticated user is able to introduce SQL Injection using the Awie export module

EPSS 13%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 96.3.963 × 2019.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon Infra Monitoring (Awie export modules) allows SQL Injection to unauthenticated user. This issue affects Infra Monitoring: from 25.10.0 before 25.10.2, from 24.10.0 before 24.10.3, from 24.04.0 before 24.04.3.

Affected

ProductAffectedFixed inSource
Infra Monitoring25.10.0 – < 25.10.225.10.2CNA
Infra Monitoring24.10.0 – < 24.10.324.10.3CNA
Infra Monitoring24.04.0 – < 24.04.324.04.3CNA

Scores by source

Centreon (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/centreon/centreon/releasesadvisorythewatch.centreon.com/latest-security-bulletins-64/cve-2025-15029-centreon-awie-critical-severity-5356