devcode-it/openstamanager Security Advisories for v2.9.7 (17)
-
[LOW] OpenSTAManager has HTML Injection in modules/utenti/edit.php
PKSA-nvw4-h4ry-dgt3 CVE-2026-44701 GHSA-crx4-7mmq-j74j
Affected version: <=2.10.1
Reported by:
GitHub -
[HIGH] OpenSTAManager contains an arbitrary file upload vulnerability in its module update functionality
PKSA-4d6v-4cnw-287h CVE-2026-38751 GHSA-rm34-fg4m-39mw
Affected version: <=2.10-beta
Reported by:
GitHub -
[HIGH] OpenSTAManager has a SQL Injection via righe Parameter in confronta_righe Modals
PKSA-398m-bjsp-p21n CVE-2026-35470 GHSA-mmm5-3g4x-qw39
Affected version: <=2.10.1
Reported by:
GitHub -
[HIGH] OpenSTAManager: SQL Injection via Aggiornamenti Module
PKSA-dx7q-hp3f-cn12 CVE-2026-35168 GHSA-2fr7-cc4f-wh98
Affected version: <=2.10.1
Reported by:
GitHub -
[HIGH] OpenSTAManager Affected by Remote Code Execution via Insecure Deserialization in OAuth2
PKSA-7wd8-5d3q-gt4k CVE-2026-29782 GHSA-whv5-4q2f-q68g
Affected version: <=2.10.1
Reported by:
GitHub -
[HIGH] OpenSTAManager has a Time-Based Blind SQL Injection via `options[stato]` Parameter
PKSA-84pv-3jy7-8y8y CVE-2026-28805 GHSA-3gw8-3mg3-jmpc
Affected version: <=2.10.1
Reported by:
GitHub -
[CRITICAL] OpenSTAManager affected by unauthenticated privilege escalation via modules/utenti/actions.php
PKSA-gkxr-gfn8-3tk2 CVE-2026-27012 GHSA-247v-7cw6-q57v
Affected version: <=2.9.8
Reported by:
GitHub -
[MEDIUM] OpenSTAManager Affected by XSS in modifica_iva.php via righe parameter
PKSA-xj58-vqx8-fbpq CVE-2026-24415 GHSA-jfgp-g7x7-j25j
Affected version: <2.9.8
Reported by:
GitHub -
[HIGH] OpenSTAManager has a SQL Injection in the Prima Nota module
PKSA-6h6r-npfh-qb3m CVE-2026-24419 GHSA-4j2x-jh4m-fqv6
Affected version: <=2.9.8
Reported by:
GitHub -
[HIGH] OpenSTAManager has a SQL Injection vulnerability in the Scadenzario bulk operations module
PKSA-ff9m-7w2n-x2fw CVE-2026-24418 GHSA-4xwv-49c8-fvhq
Affected version: <=2.9.8
Reported by:
GitHub -
[HIGH] OpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of Service
PKSA-h29d-v9rg-p75n CVE-2026-24417 GHSA-4hc4-8599-xh2h
Affected version: <2.9.8
Reported by:
GitHub -
[HIGH] OpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing Module
PKSA-9s5k-763f-q4yd CVE-2026-24416 GHSA-p864-fqgv-92q4
Affected version: <=2.9.8
Reported by:
GitHub -
[HIGH] OpenSTAManager has a SQL Injection in Scadenzario Print Template
PKSA-vrdb-wqb7-67h2 CVE-2025-69216 GHSA-q6g3-fv43-m2w6
Affected version: <=2.9.8
Reported by:
GitHub -
[HIGH] OpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint)
PKSA-wvq9-cxvz-jy62 CVE-2025-69214 GHSA-qjv8-63xq-gq8m
Affected version: <=2.9.8
Reported by:
GitHub -
[CRITICAL] OpenSTAManager has an OS Command Injection in P7M File Processing
PKSA-myj2-kgh7-vymm CVE-2025-69212 GHSA-25fp-8w8p-mx36
Affected version: <=2.9.8
Reported by:
GitHub -
[HIGH] OpenSTAManager has an SQL Injection in the Stampe Module
PKSA-z7vr-c7n6-k2xn CVE-2025-69215 GHSA-qx9p-w3vj-q24q
Affected version: <=2.9.8
Reported by:
GitHub -
[HIGH] OpenSTAManager has a SQL Injection in ajax_complete.php (get_sedi endpoint)
PKSA-8235-xswg-bmnf CVE-2025-69213 GHSA-w995-ff8h-rppg
Affected version: <=2.9.8
Reported by:
GitHub