CVE-2025-12514

A user with elevated privileges is able to introduce a SQL Injection using the Open-tickets Notification rules configuration parameters

State: Published
Severity: 7.2 High
Published: Dec 22, 2025
Updated: Jan 5, 2026
Reserved: Oct 30, 2025

Read the record on cve.org

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon Infra Monitoring - Open-tickets (Notification rules configuration parameters, Open tickets modules) allows

SQL Injection to user with elevated privileges.This issue affects Infra Monitoring - Open-tickets: from 24.10.0 before 24.10.5, from 24.04.0 before 24.04.5, from 23.10.0 before 23.10.4.

Scores

CVSS	Score	Vector	Source
3.1	7.2 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	Centreon

Weaknesses

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected Products

Product	Versions
Infra Monitoring - Open-ticketsCentreon	24.10.0 to before 24.10.5Affected 24.04.0 to before 24.04.5Affected 23.10.0 to before 23.10.4Affected

References

https://github.com/centreon/centreon/releasesrelease-notes
https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-12514-centreon-open-tickets-high-severity-5343vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.