Centreon before 19.04.15 allows remote attackers to execute arbitrary OS commands by placing shell metacharacters in RRDdatabasestatuspath (via a main.get.php request) and then visiting the include/views/graphs/graphStatus/displayServiceStatus.php page.
Centreon before 19.10.7 exposes Session IDs in server responses.
SQL injection in Centreon