CVE-2026-35470: high-severity vulnerability in devcode-it openstamanager
OpenSTAManager has a SQL Injection via righe Parameter in confronta_righe Modals
Published · Updated
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.8epss 0.4%
exploitation probability
0.4%top 64% of all CVEs
observed exploitation
nono source reports it
OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to 2.10.2, confronta_righe.php files across different modules in OpenSTAManager contain an SQL Injection vulnerability. The righe parameter received via $_GET['righe'] is directly concatenated into an SQL query without any sanitization, parameterization or validation. An authenticated attacker can inject arbitrary SQL statements to extract sensitive data from the database, including user credentials, customer information, invoice data and any other stored data. This vulnerability is fixed in 2.10.2.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
devcode-it · openstamanagerRelated CVEs — devcode-it openstamanager
In the same product, most dangerous first.
CVE-2025-69212CRITICALOpenSTAManager has an OS Command Injection in P7M File ProcessingEPSS 1.9%CVE-2026-35168HIGHOpenSTAManager: SQL Injection via Aggiornamenti ModuleEPSS 0.7%CVE-2026-27012CRITICALUnauthenticated privilege escalation in OpenSTAManager via modules/utenti/actions.phpEPSS 0.6%CVE-2026-29782HIGHOpenSTAManager: Remote Code Execution via Insecure Deserialization in OAuth2EPSS 0.6%CVE-2025-69214HIGHOpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint)EPSS 0.5%CVE-2026-28805HIGHOpenSTAManager: Time-Based Blind SQL Injection via `options[stato]` ParameterEPSS 0.5%