certfr_avis - certfr-2026-avi-0005

CERTFR-2026-AVI-0005

Vulnerability from certfr_avis - Published: 2026-01-06 - Updated: 2026-01-06

De multiples vulnérabilités ont été découvertes dans Centreon Open Tickets. Elles permettent à un attaquant de provoquer une injection SQL (SQLi) et une injection de code indirecte à distance (XSS).

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Centreon	open tickets	Centreon Open Tickets versions 24.10.x antérieures à 24.10.15
Centreon	open tickets	Centreon Open Tickets versions 23.x antérieures à 23.10.29
Centreon	open tickets	Centreon Open Tickets versions 24.x antérieures à 24.04.19
Centreon	open tickets	Centreon Open Tickets versions 25.x antérieures à 25.10.0

References

Title

Publication Time

Tags

Bulletin de sécurité Centreon cve-2025-54890-centreon-web-medium-severity-5342	2026-01-05	vendor-advisory
Bulletin de sécurité Centreon cve-2025-12514-centreon-open-tickets-high-severity-5343	2026-01-05	vendor-advisory
Bulletin de sécurité Centreon cve-2025-8460-centreon-open-tickets-medium-severity-5344	2026-01-05	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Centreon Open Tickets versions 24.10.x ant\u00e9rieures \u00e0 24.10.15",
      "product": {
        "name": "open tickets",
        "vendor": {
          "name": "Centreon",
          "scada": false
        }
      }
    },
    {
      "description": "Centreon Open Tickets versions 23.x ant\u00e9rieures \u00e0 23.10.29",
      "product": {
        "name": "open tickets",
        "vendor": {
          "name": "Centreon",
          "scada": false
        }
      }
    },
    {
      "description": "Centreon Open Tickets versions 24.x ant\u00e9rieures \u00e0 24.04.19",
      "product": {
        "name": "open tickets",
        "vendor": {
          "name": "Centreon",
          "scada": false
        }
      }
    },
    {
      "description": "Centreon Open Tickets versions 25.x ant\u00e9rieures \u00e0 25.10.0",
      "product": {
        "name": "open tickets",
        "vendor": {
          "name": "Centreon",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-54890",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-54890"
    },
    {
      "name": "CVE-2025-12514",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-12514"
    },
    {
      "name": "CVE-2025-8460",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-8460"
    }
  ],
  "initial_release_date": "2026-01-06T00:00:00",
  "last_revision_date": "2026-01-06T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0005",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-01-06T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Injection SQL (SQLi)"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Centreon Open Tickets. Elles permettent \u00e0 un attaquant de provoquer une injection SQL (SQLi) et une injection de code indirecte \u00e0 distance (XSS).",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Centreon Open Tickets",
  "vendor_advisories": [
    {
      "published_at": "2026-01-05",
      "title": "Bulletin de s\u00e9curit\u00e9 Centreon cve-2025-54890-centreon-web-medium-severity-5342",
      "url": "https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-54890-centreon-web-medium-severity-5342"
    },
    {
      "published_at": "2026-01-05",
      "title": "Bulletin de s\u00e9curit\u00e9 Centreon cve-2025-12514-centreon-open-tickets-high-severity-5343",
      "url": "https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-12514-centreon-open-tickets-high-severity-5343"
    },
    {
      "published_at": "2026-01-05",
      "title": "Bulletin de s\u00e9curit\u00e9 Centreon cve-2025-8460-centreon-open-tickets-medium-severity-5344",
      "url": "https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-8460-centreon-open-tickets-medium-severity-5344"
    }
  ]
}

CVE-2025-12514 (GCVE-0-2025-12514)

Vulnerability from cvelistv5 – Published: 2025-12-22 10:59 – Updated: 2026-01-05 09:52

Title

A user with elevated privileges is able to introduce a SQL Injection using the Open-tickets Notification rules configuration parameters

Summary

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon Infra Monitoring - Open-tickets (Notification rules configuration parameters, Open tickets modules) allows SQL Injection to user with elevated privileges.This issue affects Infra Monitoring - Open-tickets: from 24.10.0 before 24.10.5, from 24.04.0 before 24.04.5, from 23.10.0 before 23.10.4.

Severity ?

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

Centreon

References

URL

Tags

	https://github.com/centreon/centreon/releases	release-notes
	https://thewatch.centreon.com/latest-security-bul…	vendor-advisory

Impacted products

	Vendor	Product	Version
	Centreon	Infra Monitoring - Open-tickets	Affected: 24.10.0 , < 24.10.5 (custom) Affected: 24.04.0 , < 24.04.5 (custom) Affected: 23.10.0 , < 23.10.4 (custom)

Credits

Marcelo Queiroz

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-12514",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-22T13:00:53.955586Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-22T13:03:40.534Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Notification rules configuration parameters",
            "Open tickets"
          ],
          "product": "Infra Monitoring - Open-tickets",
          "vendor": "Centreon",
          "versions": [
            {
              "lessThan": "24.10.5",
              "status": "affected",
              "version": "24.10.0",
              "versionType": "custom"
            },
            {
              "lessThan": "24.04.5",
              "status": "affected",
              "version": "24.04.0",
              "versionType": "custom"
            },
            {
              "lessThan": "23.10.4",
              "status": "affected",
              "version": "23.10.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Marcelo Queiroz"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in Centreon Infra Monitoring - Open-tickets (Notification rules configuration parameters, Open tickets modules) allows \n\nSQL Injection to user with elevated privileges.\u003cp\u003eThis issue affects Infra Monitoring - Open-tickets: from 24.10.0 before 24.10.5, from 24.04.0 before 24.04.5, from 23.10.0 before 23.10.4.\u003c/p\u003e"
            }
          ],
          "value": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in Centreon Infra Monitoring - Open-tickets (Notification rules configuration parameters, Open tickets modules) allows \n\nSQL Injection to user with elevated privileges.This issue affects Infra Monitoring - Open-tickets: from 24.10.0 before 24.10.5, from 24.04.0 before 24.04.5, from 23.10.0 before 23.10.4."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-66",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-66 SQL Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-05T09:52:48.786Z",
        "orgId": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7",
        "shortName": "Centreon"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/centreon/centreon/releases"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-12514-centreon-open-tickets-high-severity-5343"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "A user with elevated privileges is able to introduce a SQL Injection using the Open-tickets Notification rules configuration parameters",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7",
    "assignerShortName": "Centreon",
    "cveId": "CVE-2025-12514",
    "datePublished": "2025-12-22T10:59:18.155Z",
    "dateReserved": "2025-10-30T15:26:40.360Z",
    "dateUpdated": "2026-01-05T09:52:48.786Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-8460 (GCVE-0-2025-8460)

Vulnerability from cvelistv5 – Published: 2025-12-22 10:55 – Updated: 2026-01-05 09:51

Title

A user with elevated privileges can inject XSS in the Notification rules configuration page

Summary

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Notification rules, Open tickets module) allows Stored XSS by users with elevated privileges.This issue affects Infra Monitoring: from 24.10.0 before 24.10.5, from 24.04.0 before 24.04.5, from 23.10.0 before 23.10.4.

Severity ?

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Assigner

Centreon

References

URL

Tags

	https://github.com/centreon/centreon/releases	release-notes
	https://thewatch.centreon.com/latest-security-bul…	vendor-advisory

Impacted products

	Vendor	Product	Version
	Centreon	Infra Monitoring	Affected: 24.10.0 , < 24.10.5 (custom) Affected: 24.04.0 , < 24.04.5 (custom) Affected: 23.10.0 , < 23.10.4 (custom)

Credits

Marcelo Queiroz

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-8460",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-22T13:06:38.809854Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-22T13:07:32.339Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Notification rules",
            "Open tickets"
          ],
          "product": "Infra Monitoring",
          "vendor": "Centreon",
          "versions": [
            {
              "lessThan": "24.10.5",
              "status": "affected",
              "version": "24.10.0",
              "versionType": "custom"
            },
            {
              "lessThan": "24.04.5",
              "status": "affected",
              "version": "24.04.0",
              "versionType": "custom"
            },
            {
              "lessThan": "23.10.4",
              "status": "affected",
              "version": "23.10.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Marcelo Queiroz"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027) vulnerability in Centreon Infra Monitoring (Notification rules, Open tickets module) \n\nallows Stored \n\nXSS by users with elevated privileges.\u003cp\u003eThis issue affects Infra Monitoring: from 24.10.0 before 24.10.5, from 24.04.0 before 24.04.5, from 23.10.0 before 23.10.4.\u003c/p\u003e"
            }
          ],
          "value": "Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027) vulnerability in Centreon Infra Monitoring (Notification rules, Open tickets module) \n\nallows Stored \n\nXSS by users with elevated privileges.This issue affects Infra Monitoring: from 24.10.0 before 24.10.5, from 24.04.0 before 24.04.5, from 23.10.0 before 23.10.4."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-592",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-592 Stored XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-05T09:51:56.936Z",
        "orgId": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7",
        "shortName": "Centreon"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/centreon/centreon/releases"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-8460-centreon-open-tickets-medium-severity-5344"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "A user with elevated privileges can inject XSS in the Notification rules configuration page",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7",
    "assignerShortName": "Centreon",
    "cveId": "CVE-2025-8460",
    "datePublished": "2025-12-22T10:55:58.934Z",
    "dateReserved": "2025-08-01T13:57:56.199Z",
    "dateUpdated": "2026-01-05T09:51:56.936Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-54890 (GCVE-0-2025-54890)

Vulnerability from cvelistv5 – Published: 2025-12-22 11:07 – Updated: 2026-01-05 09:51

Title

A user with elevated privileges can inject XSS in the Hostgroups configuration page

Summary

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Hostgroup configuration page) allows Stored XSS by users with elevated privileges.This issue affects Infra Monitoring: from 24.10.0 before 24.10.15, from 24.04.0 before 24.04.19, from 23.10.0 before 23.10.29.

Severity ?

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Assigner

Centreon

References

URL

Tags

	https://github.com/centreon/centreon/releases	release-notes
	https://thewatch.centreon.com/latest-security-bul…	vendor-advisory

Impacted products

	Vendor	Product	Version
	Centreon	Infra Monitoring	Affected: 24.10.0 , < 24.10.15 (custom) Affected: 24.04.0 , < 24.04.19 (custom) Affected: 23.10.0 , < 23.10.29 (custom)

Credits

Marcelo Queiroz

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-54890",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-22T13:00:05.415109Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-22T13:00:14.622Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Hostgroup configuration"
          ],
          "product": "Infra Monitoring",
          "vendor": "Centreon",
          "versions": [
            {
              "lessThan": "24.10.15",
              "status": "affected",
              "version": "24.10.0",
              "versionType": "custom"
            },
            {
              "lessThan": "24.04.19",
              "status": "affected",
              "version": "24.04.0",
              "versionType": "custom"
            },
            {
              "lessThan": "23.10.29",
              "status": "affected",
              "version": "23.10.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Marcelo Queiroz"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027) vulnerability in Centreon Infra Monitoring (Hostgroup configuration page) allows Stored \n\nXSS by users with elevated privileges.\u003cp\u003eThis issue affects Infra Monitoring: from 24.10.0 before 24.10.15, from 24.04.0 before 24.04.19, from 23.10.0 before 23.10.29.\u003c/p\u003e"
            }
          ],
          "value": "Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027) vulnerability in Centreon Infra Monitoring (Hostgroup configuration page) allows Stored \n\nXSS by users with elevated privileges.This issue affects Infra Monitoring: from 24.10.0 before 24.10.15, from 24.04.0 before 24.04.19, from 23.10.0 before 23.10.29."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-592",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-592 Stored XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-05T09:51:16.625Z",
        "orgId": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7",
        "shortName": "Centreon"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/centreon/centreon/releases"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-54890-centreon-web-medium-severity-5342"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "A user with elevated privileges can inject XSS in the Hostgroups configuration page",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7",
    "assignerShortName": "Centreon",
    "cveId": "CVE-2025-54890",
    "datePublished": "2025-12-22T11:07:28.095Z",
    "dateReserved": "2025-07-31T18:22:28.420Z",
    "dateUpdated": "2026-01-05T09:51:16.625Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CERTFR-2026-AVI-0005

Solutions

CVE-2025-12514 (GCVE-0-2025-12514)

CVE-2025-8460 (GCVE-0-2025-8460)

CVE-2025-54890 (GCVE-0-2025-54890)

Tags

Sightings

Nomenclature