9.8Critical
CVE-2025-15029An unauthenticated user is able to introduce SQL Injection using the Awie export module
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon Infra Monitoring (Awie export modules) allows SQL Injection to unauthenticated user. This issue affects Infra Monitoring: from 25.10.0 before 25.10.2, from 24.10.0 before 24.10.3, from 24.04.0 before 24.04.3.
Weakness (CWE):
CWE-89
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| centreon | awie | 24.04.0 – < 24.04.3 | |
| Centreon | Infra Monitoring | 25.10.0 – < 25.10.2, 24.10.0 – < 24.10.3, 24.04.0 – < 24.04.3 |
References and patches
- https://github.com/centreon/centreon/releases Release Notes
- https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-15029-centreon-awie-critical-severity-5356 vendor-advisoryPatchVendor Advisory
CPE matches (NVD) (3)
cpe:2.3:a:centreon:awie:*:*:*:*:*:*:*:*≥ 24.04.0 < 24.04.3cpe:2.3:a:centreon:awie:*:*:*:*:*:*:*:*≥ 24.10.0 < 24.10.3cpe:2.3:a:centreon:awie:*:*:*:*:*:*:*:*≥ 25.10.0 < 25.10.2