CVE-2025-4648 | BDVDB-2026-278396 Detail

Description#

The content of a SVG file, received as input in Centreon web, was not properly checked. Allows Reflected XSS. A user with elevated privileges can inject JS script by altering the content of a SVG media, during the submit request. This issue affects web: from 24.10.0 before 24.10.5, from 24.04.0 before 24.04.11, from 23.10.0 before 23.10.22, from 23.04.0 before 23.04.27, from 22.10.0 before 22.10.29.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12025-05-13Record published in the CVE List.
2. Version 22025-10-08Most recent update recorded in the CVE List.