CVE-2021-37556
High · 8.8CVSS
8.8
EPSS
27.4%
Published
Aug 3, 2021
CISA due date
—
The record
A SQL injection vulnerability in reporting export in Centreon before 20.04.14, 20.10.8, and 21.04.2 allows remote authenticated (but low-privileged) attackers to execute arbitrary SQL commands via the include/reporting/dashboard/csvExport/csv_HostGroupLogs.php start and end parameters.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| packagist | centreon/centreon | 20.10.0 | No fix |
| packagist | centreon/centreon | 21.04.0 | No fix |
Related vulnerabilities
- CVE-2021-37557 A SQL injection vulnerability in image generation in Centreon before 20.04.14, 20.10.8… Also affects centreon/centreon
- CVE-2019-16405 Centreon Web before 2.8.30, 18.10.x before 18.10.8, 19.04.x before 19.04.5 and 19.10.x… Also affects centreon/centreon
- CVE-2019-13024 Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows… Also affects centreon/centreon
- CVE-2026-87936 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')… CWE-89
- CVE-2026-87938 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')… CWE-89
- CVE-2026-114664 Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the… CWE-89
- CVE-2026-114577 A vulnerability was found in oretnom23 php-travel-agency-system. CWE-89
- CVE-2026-113406 BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. CWE-89