CVE-2025-65103
High · 8.8CVSS
8.8
EPSS
0.4%
Published
Nov 19, 2025
CISA due date
—
The record
OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.9.5, an authenticated SQL Injection vulnerability in the API allows any user, regardless of permission level, to execute arbitrary SQL queries. By manipulating the display parameter in an API request, an attacker can exfiltrate, modify, or delete any data in the database, leading to a full system compromise. This issue has been patched in version 2.9.5.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | devcode-it/openstamanager | 0 | 2.9.5 |
Related vulnerabilities
- GHSA-2jm2-2p35-rp3j OpenSTAManager has Authenticated SQL Injection in API via 'display' parameter Same vulnerability
- CVE-2026-24415 OpenSTAManager is an open source management software for technical assistance and… Also affects devcode-it/openstamanager
- CVE-2026-27012 OpenSTAManager is an open source management software for technical assistance and… Also affects devcode-it/openstamanager
- GHSA-247v-7cw6-q57v OpenSTAManager affected by unauthenticated privilege escalation via… Also affects devcode-it/openstamanager
- GHSA-jfgp-g7x7-j25j OpenSTAManager Affected by XSS in modifica_iva.php via righe parameter Also affects devcode-it/openstamanager
- CVE-2026-24418 OpenSTAManager is an open source management software for technical assistance and… Also affects devcode-it/openstamanager
- CVE-2026-24417 OpenSTAManager is an open source management software for technical assistance and… Also affects devcode-it/openstamanager
- CVE-2026-24416 OpenSTAManager is an open source management software for technical assistance and… Also affects devcode-it/openstamanager