Vulnerabilities

Filters

2 selected

17 records

Sort

Vendor: devcode-it Component: Openstamanager Clear all filters

TI-2026-28201 CVE-2026-38751 · GHSA-rm34-fg4m-39mw

OpenSTAManager version 2.10 and earlier contains an arbitrary file upload vulnerability…

LOW 34

OpenSTAManager version 2.10 and earlier contains an arbitrary file upload vulnerability in the module update functionality (modules/aggiornamenti/upload_modules.php)

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00464 Published 2026-05-04 No fix listed CWE-434

TI-2026-27600 CVE-2026-35470 · GHSA-mmm5-3g4x-qw39

OpenSTAManager has a SQL Injection via righe Parameter in confronta_righe Modals

HIGH 73

OpenSTAManager is an open source management software for technical assistance and invoicing.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00423 Published 2026-04-06 Fixed in 2.10.2 CWE-89

TI-2026-27322 CVE-2026-35168 · GHSA-2fr7-cc4f-wh98

OpenSTAManager: SQL Injection via Aggiornamenti Module

HIGH 73

OpenSTAManager is an open source management software for technical assistance and invoicing.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0068 Published 2026-04-02 Fixed in 2.10.2 CWE-89

TI-2026-22999 CVE-2026-28805 · GHSA-3gw8-3mg3-jmpc

OpenSTAManager: Time-Based Blind SQL Injection via `options[stato]` Parameter

HIGH 73

OpenSTAManager is an open source management software for technical assistance and invoicing.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00468 Published 2026-04-02 Fixed in 2.10.2 CWE-89

TI-2026-23368 CVE-2026-29782 · GHSA-whv5-4q2f-q68g

OpenSTAManager: Remote Code Execution via Insecure Deserialization in OAuth2

HIGH 67

OpenSTAManager is an open source management software for technical assistance and invoicing.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00591 Published 2026-04-02 Fixed in 2.10.2 CWE-502

TI-2026-21486 CVE-2026-27012 · GHSA-247v-7cw6-q57v

Unauthenticated privilege escalation in OpenSTAManager via modules/utenti/actions.php

HIGH 82

OpenSTAManager is an open source management software for technical assistance and invoicing.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00598 Published 2026-03-03 No fix listed CWE-306

TI-2026-19682 CVE-2026-24415 · GHSA-jfgp-g7x7-j25j

OpenSTAManager affected by reflected XSS in modifica_iva.php via righe parameter

MEDIUM 56

OpenSTAManager is an open source management software for technical assistance and invoicing.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00284 Published 2026-03-03 Fixed in 2.9.8 CWE-79

TI-2025-42666 CVE-2025-69212 · GHSA-25fp-8w8p-mx36

OpenSTAManager has an OS Command Injection in P7M File Processing

MEDIUM 46

OpenSTAManager is an open source management software for technical assistance and invoicing.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.01915 Published 2026-02-06 No fix listed CWE-78

TI-2025-42668 CVE-2025-69214 · GHSA-qjv8-63xq-gq8m

OpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint)

MEDIUM 40

OpenSTAManager is an open source management software for technical assistance and invoicing.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.0046 Published 2026-02-06 No fix listed CWE-89

TI-2025-42670 CVE-2025-69216 · GHSA-q6g3-fv43-m2w6

OpenSTAManager has an SQL Injection in Scadenzario Print Template

MEDIUM 40

OpenSTAManager is an open source management software for technical assistance and invoicing.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00393 Published 2026-02-06 No fix listed CWE-89

TI-2026-19683 CVE-2026-24416 · GHSA-p864-fqgv-92q4

OpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing Module

MEDIUM 40

OpenSTAManager is an open source management software for technical assistance and invoicing.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00406 Published 2026-02-06 No fix listed CWE-89

TI-2026-19684 CVE-2026-24417 · GHSA-4hc4-8599-xh2h

OpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of Service

HIGH 73

OpenSTAManager is an open source management software for technical assistance and invoicing.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00406 Published 2026-02-06 No fix listed CWE-89

TI-2026-19685 CVE-2026-24418 · GHSA-4xwv-49c8-fvhq

OpenSTAManager has an SQL Injection vulnerability in the Scadenzario bulk operations module

HIGH 73

OpenSTAManager is an open source management software for technical assistance and invoicing.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00399 Published 2026-02-06 No fix listed CWE-89

TI-2026-19686 CVE-2026-24419 · GHSA-4j2x-jh4m-fqv6

OpenSTAManager has an SQL Injection in the Prima Nota module

HIGH 79

OpenSTAManager is an open source management software for technical assistance and invoicing.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00382 Published 2026-02-06 No fix listed CWE-89

TI-2025-42669 CVE-2025-69215 · GHSA-qx9p-w3vj-q24q

OpenSTAManager has an SQL Injection in the Stampe Module

MEDIUM 40

OpenSTAManager is an open source management software for technical assistance and invoicing.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00444 Published 2026-02-04 No fix listed CWE-89

TI-2025-42667 CVE-2025-69213 · GHSA-w995-ff8h-rppg

OpenSTAManager has a SQL Injection in ajax_complete.php (get_sedi endpoint)

HIGH 73

OpenSTAManager is an open source management software for technical assistance and invoicing.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00453 Published 2026-02-04 No fix listed CWE-89

TI-2023-20151 CVE-2023-38878 · GHSA-h3r4-4c9w-25g8

A reflected cross-site scripting (XSS) vulnerability in DevCode OpenSTAManager versions…

MEDIUM 60

A reflected cross-site scripting (XSS) vulnerability in DevCode OpenSTAManager versions 2.4.24 to 2.4.47 may allow a remote attacker to execute arbitrary JavaScript in the web browser of a victim by injecting a malicious…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00773 Published 2023-09-11 No fix listed CWE-79