CVE-2025-5946

HighCVSS 7.2/10Last modified Oct 8, 2026

Description

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Centreon Infra Monitoring (Poller reload setup in the configuration modules) allows OS Command Injection. On the poller parameters page, a user with high privilege is able to concatenate custom instructions into the poller reload command.

This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Oct 14, 2025
Last modified: Oct 8, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-594607.5The system is deployed in its default state, with configuration settings that do not comply with the latest best practices for restricting a CVE-2025-594619.8A remote unauthenticated attacker may use the unauthenticated C++ API to access or modify sensitive data and disrupt services.CVE-2025-594627.5An attacker who tampers with the C++ CLI client may crash the UpdateService during file transfers, disrupting updates and availability.CVE-2025-594637.5An attacker may cause chunk-size mismatches that block file transfers and prevent subsequent transfers.CVE-2025-594647.5A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buff CVE-2025-594657.5A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` er CVE-2025-594667.5We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.crea CVE-2025-594679.6A Cross-Site Scripting (XSS) vulnerability in the UCRM Argentina AFIP invoices Plugin (v1.2.0 and earlier) could allow privilege escalation CVE-2025-594689.1This vulnerability allows a Backup Administrator to perform remote code execution (RCE) as the postgres user by sending a malicious passwor CVE-2025-594699.0This vulnerability allows a Backup or Tape Operator to write files as root.CVE-2025-59479.8The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via authentication bypass in all versions up to, and CVE-2025-594709.0This vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a malicious interval or o