CRITICAL9.8Packagist
GHSA-247v-7cw6-q57v· CVE-2026-27012OpenSTAManager affected by unauthenticated privilege escalation via modules/utenti/actions.php
Modified: 3/4/2026
package
Packagist/devcode-it/openstamanager
pkg:packagist/devcode-it/openstamanager
CRITICALPackagist
GHSA-25fp-8w8p-mx36· CVE-2025-69212OpenSTAManager has an OS Command Injection in P7M File Processing
Modified: 2/22/2026
HIGH8.8Packagist
GHSA-2fr7-cc4f-wh98· CVE-2026-35168OpenSTAManager: SQL Injection via Aggiornamenti Module
Modified: 4/3/2026
HIGH8.8Packagist
GHSA-2jm2-2p35-rp3j· CVE-2025-65103OpenSTAManager has Authenticated SQL Injection in API via 'display' parameter
Modified: 11/20/2025
HIGH8.8Packagist
GHSA-3gw8-3mg3-jmpc· CVE-2026-28805OpenSTAManager has a Time-Based Blind SQL Injection via `options[stato]` Parameter
Modified: 4/6/2026
HIGHPackagist
GHSA-4hc4-8599-xh2h· CVE-2026-24417OpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of Service
Modified: 9/10/2026
HIGHPackagist
GHSA-4j2x-jh4m-fqv6· CVE-2026-24419OpenSTAManager has a SQL Injection in the Prima Nota module
Modified: 2/10/2026
HIGHPackagist
GHSA-4xwv-49c8-fvhq· CVE-2026-24418OpenSTAManager has a SQL Injection vulnerability in the Scadenzario bulk operations module
Modified: 2/10/2026
LOW3.5Packagist
GHSA-crx4-7mmq-j74j· CVE-2026-44701OpenSTAManager has HTML Injection in modules/utenti/edit.php
Modified: 8/26/2026
MEDIUMPackagist
GHSA-jfgp-g7x7-j25j· CVE-2026-24415OpenSTAManager Affected by XSS in modifica_iva.php via righe parameter
Modified: 3/4/2026
HIGH8.8Packagist
GHSA-mmm5-3g4x-qw39· CVE-2026-35470OpenSTAManager has a SQL Injection via righe Parameter in confronta_righe Modals
Modified: 4/3/2026
HIGHPackagist
GHSA-p864-fqgv-92q4· CVE-2026-24416OpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing Module
Modified: 2/6/2026
HIGHPackagist
GHSA-q6g3-fv43-m2w6· CVE-2025-69216OpenSTAManager has a SQL Injection in Scadenzario Print Template
Modified: 2/10/2026
HIGH8.8Packagist
GHSA-qjv8-63xq-gq8m· CVE-2025-69214OpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint)
Modified: 2/10/2026
HIGHPackagist
GHSA-qx9p-w3vj-q24q· CVE-2025-69215OpenSTAManager has an SQL Injection in the Stampe Module
Modified: 2/4/2026
HIGH7.2Packagist
GHSA-rm34-fg4m-39mw· CVE-2026-38751OpenSTAManager contains an arbitrary file upload vulnerability in its module update functionality
Modified: 5/8/2026
HIGHPackagist
GHSA-w995-ff8h-rppg· CVE-2025-69213OpenSTAManager has a SQL Injection in ajax_complete.php (get_sedi endpoint)
Modified: 2/22/2026
HIGH7.2Packagist
GHSA-whv5-4q2f-q68g· CVE-2026-29782OpenSTAManager Affected by Remote Code Execution via Insecure Deserialization in OAuth2
Modified: 4/6/2026