CVE-2026-35470: falha de alta gravidade em devcode-it openstamanager
OpenSTAManager has a SQL Injection via righe Parameter in confronta_righe Modals
Publicada em · Atualizada em
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.8epss 0.4%
probabilidade de exploração
0.4%top 64% das CVEs
exploração observada
nãonenhuma fonte reporta
OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to 2.10.2, confronta_righe.php files across different modules in OpenSTAManager contain an SQL Injection vulnerability. The righe parameter received via $_GET['righe'] is directly concatenated into an SQL query without any sanitization, parameterization or validation. An authenticated attacker can inject arbitrary SQL statements to extract sensitive data from the database, including user credentials, customer information, invoice data and any other stored data. This vulnerability is fixed in 2.10.2.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
devcode-it · openstamanagerCVEs relacionadas — devcode-it openstamanager
No mesmo produto, das mais perigosas para as menos.
CVE-2025-69212CRITICALOpenSTAManager has an OS Command Injection in P7M File ProcessingEPSS 1.9%CVE-2026-35168HIGHOpenSTAManager: SQL Injection via Aggiornamenti ModuleEPSS 0.7%CVE-2026-27012CRITICALUnauthenticated privilege escalation in OpenSTAManager via modules/utenti/actions.phpEPSS 0.6%CVE-2026-29782HIGHOpenSTAManager: Remote Code Execution via Insecure Deserialization in OAuth2EPSS 0.6%CVE-2025-69214HIGHOpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint)EPSS 0.5%CVE-2026-28805HIGHOpenSTAManager: Time-Based Blind SQL Injection via `options[stato]` ParameterEPSS 0.5%