What’s Vulnerable › Products
devcode-it openstamanager vulnerabilities
18 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 17 published in the last 12 months.
Check whether your devcode-it openstamanager version is affected
Latest devcode-it openstamanager vulnerabilities
- CVE-2026-38751 — (CVSS 7.2)
- CVE-2026-35470 — OpenSTAManager has a SQL Injection via righe Parameter in confronta_righe Modals (CVSS 8.8)
- CVE-2026-35168 — OpenSTAManager: SQL Injection via Aggiornamenti Module (CVSS 8.8)
- CVE-2026-29782 — OpenSTAManager: Remote Code Execution via Insecure Deserialization in OAuth2 (CVSS 7.2)
- CVE-2026-28805 — OpenSTAManager: Time-Based Blind SQL Injection via `options[stato]` Parameter (CVSS 8.8)
- CVE-2026-27012 — Unauthenticated privilege escalation in OpenSTAManager via modules/utenti/actions.php (CVSS 9.8)
- CVE-2026-24415 — OpenSTAManager affected by reflected XSS in modifica_iva.php via righe parameter (CVSS 6.1)
- CVE-2026-24418 — OpenSTAManager has an SQL Injection vulnerability in the Scadenzario bulk operations module (CVSS 6.5)
- CVE-2026-24417 — OpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of Service (CVSS 6.5)
- CVE-2026-24416 — OpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing Module (CVSS 6.5)
- CVE-2025-69216 — OpenSTAManager has an SQL Injection in Scadenzario Print Template (CVSS 6.5)
- CVE-2025-69214 — OpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint) (CVSS 8.8)
- CVE-2025-69212 — OpenSTAManager has an OS Command Injection in P7M File Processing (CVSS 8.8)
- CVE-2026-24419 — OpenSTAManager has an SQL Injection in the Prima Nota module (CVSS 6.5)
- CVE-2025-69215 — OpenSTAManager has an SQL Injection in the Stampe Module (CVSS 8.8)
- CVE-2025-69213 — OpenSTAManager has a SQL Injection in ajax_complete.php (get_sedi endpoint) (CVSS 8.8)
- CVE-2025-65103 — OpenSTAManager has an authenticated SQL Injection vulnerability in API via 'display' parameter (CVSS 8.8)
- CVE-2023-38878 — (CVSS 6.1)