CVE-2025-69216
Medium · 6.5CVSS
6.5
EPSS
0.4%
Published
Feb 6, 2026
CISA due date
—
The record
OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, an authenticated SQL injection vulnerability in OpenSTAManager's Scadenzario (Payment Schedule) print template allows any authenticated user to extract sensitive data from the database, including admin credentials, customer information, and financial records. The vulnerability exists in templates/scadenzario/init.php, where the id_anagrafica parameter is directly concatenated into an SQL query without proper sanitization. The vulnerability enables complete database read access through error-based SQL injection techniques.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | devcode-it/openstamanager | 0 | No fix |
Related vulnerabilities
- CVE-2026-24415 OpenSTAManager is an open source management software for technical assistance and… Also affects devcode-it/openstamanager
- CVE-2026-27012 OpenSTAManager is an open source management software for technical assistance and… Also affects devcode-it/openstamanager
- GHSA-247v-7cw6-q57v OpenSTAManager affected by unauthenticated privilege escalation via… Also affects devcode-it/openstamanager
- GHSA-jfgp-g7x7-j25j OpenSTAManager Affected by XSS in modifica_iva.php via righe parameter Also affects devcode-it/openstamanager
- CVE-2026-24418 OpenSTAManager is an open source management software for technical assistance and… Also affects devcode-it/openstamanager
- CVE-2026-24417 OpenSTAManager is an open source management software for technical assistance and… Also affects devcode-it/openstamanager
- CVE-2026-24416 OpenSTAManager is an open source management software for technical assistance and… Also affects devcode-it/openstamanager
- CVE-2025-69214 OpenSTAManager is an open source management software for technical assistance and… Also affects devcode-it/openstamanager