PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2026-2749] [EN] Deep Looking into Centreon

yokai.hakaisecurity.io | vulnerability | CVE-2026-2749 | #rce | #vulnerability-research | #sql-injection | #path-traversal | #research | #file-upload
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Summary In this research, three critical vulnerabilities were identified in Centreon Web and the Centreon Open Tickets module, allowing everything from full database extraction via SQL Injection to remote command execution on the server through a Path Traversal vulnerability in the file upload functionality and a Command Injection vulnerability. Exploitation requires only an authenticated session, […]
CVE
CVE-2026-2749
Published
Collected

Related coverage

vulnerability · yokai.hakaisecurity.io
[PT-BR] Deep Looking into Centreon
Introdução Nesta pesquisa, foi identificada três vulnerabilidades críticas no Centreon Web e no módulo Centreon Open Tickets, que permitem desde a extração completa do banco de dados via SQL Injection até a execução remota de comandos no servidor através de uma vulnerabilidade de Path Traversal na funcionalidade de upload de arquivos e uma vulnerabilidade de […]
vulnerability · yokai.hakaisecurity.io
OsCommerce v4 RCE: Unveiling the file upload bypass threat
In my recent research, I identified a critical vulnerability in osCommerce v4, specifically a Remote Code Execution (RCE) vulnerability enabled by bypassing file upload restrictions. I’ve always enjoyed testing file upload bypass techniques in my assessments. Vulnerabilities Identified in OsCommerce Version 4 The CVE-2024-22724 was assigned to the discovery of this vulnerability. The issue […]
vulnerability · yokai.hakaisecurity.io
GLPI - SQL injection through dynamic reports
This post details the journey of our Research Team in uncovering a SQL Injection vulnerability in GLPI, an open-source ITSM tool predominantly used in Brazil and France. We observed many companies using GLPI, and we decided to focus on finding vulnerabilities that could allow access to users’ credentials and potentially some Remote Code Execution (RCE) […]
vulnerability · vercel.com
Reproducing, disclosing, and fixing the libheif vulnerability with Hacktron and the maintainers
How Vercel and Hacktron coordinated a fix for a remote code execution vulnerability that reached Next.js image optimization through sharp, libvips, and libheif.
vulnerability · horizon3.ai
[CVE-2021-41765] Multiple Vulnerabilities in ResourceSpace
Advisory for CVE-2021-41765, a critical SQL injection vulnerability leading to remote code execution, by the Horizon3 red team.
vulnerability · horizon3.ai
Apache CVE-2021-41773, CVE-2021-42013
We wanted to do something a little bit different with this post. Our vulnerability disclosures, exploit proof-of-concepts, and attack analysis blog posts have…
Back