CVE-2025-69214: fallo de gravedad alta en devcode-it openstamanager
OpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint)
Publicada el · Actualizada el
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.7epss 0.5%
probabilidad de explotación
0.5%top 60% de las CVE
explotación observada
noninguna fuente lo reporta
OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, an SQL Injection vulnerability exists in the ajax_select.php endpoint when handling the componenti operation. An authenticated attacker can inject malicious SQL code through the options[matricola] parameter.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
devcode-it · openstamanagerCVEs relacionadas — devcode-it openstamanager
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-69212CRITICALOpenSTAManager has an OS Command Injection in P7M File ProcessingEPSS 1.9%CVE-2026-35168HIGHOpenSTAManager: SQL Injection via Aggiornamenti ModuleEPSS 0.7%CVE-2026-27012CRITICALUnauthenticated privilege escalation in OpenSTAManager via modules/utenti/actions.phpEPSS 0.6%CVE-2026-29782HIGHOpenSTAManager: Remote Code Execution via Insecure Deserialization in OAuth2EPSS 0.6%CVE-2026-28805HIGHOpenSTAManager: Time-Based Blind SQL Injection via `options[stato]` ParameterEPSS 0.5%CVE-2025-69213HIGHOpenSTAManager has a SQL Injection in ajax_complete.php (get_sedi endpoint)EPSS 0.4%