CVE-2025-69213

High · 8.8

CVSS

8.8

EPSS

0.4%

Published

Feb 4, 2026

CISA due date

—

The record

OpenSTAManager is an open source management software for technical assistance and invoicing. In version 2.9.8 and prior, a SQL Injection vulnerability exists in the ajax_complete.php endpoint when handling the get_sedi operation. An authenticated attacker can inject malicious SQL code through the idanagrafica parameter, leading to unauthorized database access. At time of publication, no known patch exists.

Affected packages

Ecosystem	Package	Introduced	Fixed
Packagist	devcode-it/openstamanager	0	No fix

Related vulnerabilities

CVE-2026-24415 OpenSTAManager is an open source management software for technical assistance and… Also affects devcode-it/openstamanager
CVE-2026-27012 OpenSTAManager is an open source management software for technical assistance and… Also affects devcode-it/openstamanager
GHSA-247v-7cw6-q57v OpenSTAManager affected by unauthenticated privilege escalation via… Also affects devcode-it/openstamanager
GHSA-jfgp-g7x7-j25j OpenSTAManager Affected by XSS in modifica_iva.php via righe parameter Also affects devcode-it/openstamanager
CVE-2026-24418 OpenSTAManager is an open source management software for technical assistance and… Also affects devcode-it/openstamanager
CVE-2026-24417 OpenSTAManager is an open source management software for technical assistance and… Also affects devcode-it/openstamanager
CVE-2026-24416 OpenSTAManager is an open source management software for technical assistance and… Also affects devcode-it/openstamanager
CVE-2025-69216 OpenSTAManager is an open source management software for technical assistance and… Also affects devcode-it/openstamanager