CVE-2025-5946

high · 7.2

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Centreon Infra Monitoring (Poller reload setup in the configuration modules) allows OS Command Injection. On the poller parameters page, a user with high privilege is able to concatenate custom instructions into the poller reload command. This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28.

7.2

CVSS

13.5%

EPSS (exploit prob.)

96th

EPSS percentile

2025-10-14

Published

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-78

Affected products

Vendor	Product	Affected versions
centreon	centreon_web	>= 23.10.0, < 23.10.28
centreon	centreon_web	>= 24.04.0, < 24.04.18
centreon	centreon_web	>= 24.10.0, < 24.10.13

Check a specific version with /api/v1/cve/match.

References

https://github.com/centreon/centreon/releases
https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-5946-centreon-web-all-versions-high-severity-5104

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-5946