A user with elevated privileges can inject XSS in the SNMP traps group configuration page
CVE-2025-54892

6.8MEDIUM

Key Information:

Vendor

Centreon

Status
Infra Monitoring
Vendor
CVE Published:
14 October 2025

What is CVE-2025-54892?

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (SNMP traps group configuration modules)

allows Stored XSS by users with elevated privileges.

This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28.

Affected Version(s)

Infra Monitoring 24.10.0 < 24.10.13

Infra Monitoring 24.04.0 < 24.04.18

Infra Monitoring 23.10.0 < 23.10.28

References

https://github.com/centreon/centreon/releases
release-notes

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marcelo Queiroz
JSON
.
CVE-2025-54892 : Cross-Site Scripting Vulnerability in Centreon Infra Monitoring by Centreon