CVE-2025-5965

high · 7.2

In the backup parameters, a user with high privilege is able to concatenate custom instructions to the backup setup. Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Centreon Infra Monitoring (Backup configuration in the administration setup modules) allows OS Command Injection.This issue affects Infra Monitoring: from 25.10.0 before 25.10.2, from 24.10.0 before 24.10.15, from 24.04.0 before 24.04.19.

7.2

CVSS

28.6%

EPSS (exploit prob.)

98th

EPSS percentile

2026-01-05

Published

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-78

Affected products

Vendor	Product	Affected versions
centreon	centreon_web	>= 24.04.0, < 24.04.19
centreon	centreon_web	>= 24.10.0, < 24.10.15
centreon	centreon_web	>= 25.10.0, < 25.10.2

Check a specific version with /api/v1/cve/match.

References

https://github.com/centreon/centreon/releases
https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-5965-centreon-web-high-severity-5362

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-5965