CVE-2025-12511
A user with elevated privileges can inject XSS in the DSM Administration’s Extensions configuration page
Summary
A user with elevated privileges can inject XSS in the DSM Administration’s Extensions configuration page
Original description
The description as published by the source.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (DSM extenstio configuration modules) allows Stored XSS
to user with elevated privileges.
This issue affects Infra Monitoring: from 25.10.0 before 25.10.1, from 24.10.0 before 24.10.4, from 24.04.0 before 24.04.8.
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory thewatch.centreon.com