CVE-2026-24419

Medium · 6.5

CVSS

6.5

EPSS

0.4%

Published

Feb 6, 2026

CISA due date

—

The record

OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contain a critical Error-Based SQL Injection vulnerability in the Prima Nota (Journal Entry) module's add.php file. The application fails to validate that comma-separated values from the id_documenti GET parameter are integers before using them in SQL IN() clauses, allowing attackers to inject arbitrary SQL commands and extract sensitive data through XPATH error messages.

Affected packages

Ecosystem	Package	Introduced	Fixed
Packagist	devcode-it/openstamanager	0	No fix

Related vulnerabilities

CVE-2026-24415 OpenSTAManager is an open source management software for technical assistance and… Also affects devcode-it/openstamanager
CVE-2026-27012 OpenSTAManager is an open source management software for technical assistance and… Also affects devcode-it/openstamanager
GHSA-247v-7cw6-q57v OpenSTAManager affected by unauthenticated privilege escalation via… Also affects devcode-it/openstamanager
GHSA-jfgp-g7x7-j25j OpenSTAManager Affected by XSS in modifica_iva.php via righe parameter Also affects devcode-it/openstamanager
CVE-2026-24418 OpenSTAManager is an open source management software for technical assistance and… Also affects devcode-it/openstamanager
CVE-2026-24417 OpenSTAManager is an open source management software for technical assistance and… Also affects devcode-it/openstamanager
CVE-2026-24416 OpenSTAManager is an open source management software for technical assistance and… Also affects devcode-it/openstamanager
CVE-2025-69216 OpenSTAManager is an open source management software for technical assistance and… Also affects devcode-it/openstamanager