CVE-2020-13252

Centreon before 19.04.15 allows remote attackers to execute arbitrary OS commands by placing shell metacharacters in RRDdatabase_status_path (via a main.get.php request) and then visiting the include/views/graphs/graphStatus/displayServiceStatus.php page.

• CWE-78

• https://engindemirbilek.github.io/centreon-19.10-rceExploit, Third Party Advisory
• https://github.com/EnginDemirbilek/EnginDemirbilek.github.io/blob/master/centreon-19.10-rce.htmlExploit, Third Party Advisory
• https://github.com/centreon/centreon/compare/19.04.13...19.04.15Patch, Third Party Advisory
• https://github.com/centreon/centreon/pull/8467Patch, Third Party Advisory
• https://engindemirbilek.github.io/centreon-19.10-rceExploit, Third Party Advisory
• https://github.com/EnginDemirbilek/EnginDemirbilek.github.io/blob/master/centreon-19.10-rce.htmlExploit, Third Party Advisory
• https://github.com/centreon/centreon/compare/19.04.13...19.04.15Patch, Third Party Advisory
• https://github.com/centreon/centreon/pull/8467Patch, Third Party Advisory

Published

May 21, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-13246An issue was discovered in Gitea through 1.11.5. An attacker…7.5
• CVE-2020-13247BooleBox Secure File Sharing Utility before 4.2.3.0 allows C…7.3
• CVE-2020-13248BooleBox Secure File Sharing Utility before 4.2.3.0 allows s…5.4
• CVE-2020-13249libmariadb/mariadb_lib.c in MariaDB Connector/C before 3.1.8…8.8
• CVE-2020-1325Azure DevOps Server and Team Foundation Services Spoofing Vu…5.4
• CVE-2020-13250HashiCorp Consul and Consul Enterprise include an HTTP API (…7.5
• CVE-2020-13253sd_wp_addr in hw/sd/sd.c in QEMU 4.2.0 uses an unvalidated a…5.5
• CVE-2020-13254An issue was discovered in Django 2.2 before 2.2.13 and 3.0 …5.9
• CVE-2020-13258Contentful through 2020-05-21 for Python allows reflected XS…6.1
• CVE-2020-13259A vulnerability in the web-based management interface of RAD…8.8
• CVE-2020-1326A Cross-site Scripting (XSS) vulnerability exists when Azure…5.4
• CVE-2020-13260A vulnerability in the web-based management interface of RAD…6.1