CVE-2025-8459 HIGH

CVE-2025-8459: A user with low privileges can inject XSS in the Monitoring Recurrent downtimes page

Vendor Centreon
Product Infra Monitoring
Weakness CWE-79 · XSS
Published October 14, 2025
Last update October 15, 2025
View on NVD All CVEs

CVSS base score

7.7/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

What the vulnerability does

01Description

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Monitoring recurrent downtime scheduler modules) allows Stored XSS.This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28.

Key dates

02Disclosure timeline

October 14, 2025 CVE published
October 15, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-10153 westboy CicadasCMS AbstractCacheManager.java search cross site scripting CVE-2024-27083 Flask-AppBuilder's OAuth login page subject to Cross Site Scripting (XSS) CVE-2025-32552 WordPress MSRP (RRP) Pricing for WooCommerce Plugin <= 1.8.1 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2025-58031 WordPress Nextend Facebook Connect Plugin <= 3.1.19 - Cross Site Scripting (XSS) Vulnerability CVE-2025-47020 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)