- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 17 · 2 critical, 14 high, 1 medium
- Registry
- Packagist
Advisories 17
- CVE-2026-38751High 7.2
OpenSTAManager version 2.10 and earlier contains an arbitrary file upload vulnerability in the module update functionality…
Affected: through 2.10-beta.
- CVE-2026-35470High 8.8
OpenSTAManager has a SQL Injection via righe Parameter in confronta_righe Modals
Affected: fixed in 2.10.2.
- CVE-2026-35168High 8.8
OpenSTAManager: SQL Injection via Aggiornamenti Module
Affected: fixed in 2.10.2.
- CVE-2026-28805High 8.8
OpenSTAManager: Time-Based Blind SQL Injection via `options[stato]` Parameter
Affected: fixed in 2.10.2.
- CVE-2026-29782High 7.2
OpenSTAManager: Remote Code Execution via Insecure Deserialization in OAuth2
Affected: fixed in 2.10.2.
- CVE-2026-27012Critical 9.8
Unauthenticated privilege escalation in OpenSTAManager via modules/utenti/actions.php
Affected: through 2.9.8.
- CVE-2026-24415Medium 5.1
OpenSTAManager affected by reflected XSS in modifica_iva.php via righe parameter
Affected: fixed in 2.9.8.
- CVE-2025-69212Critical 9.4
OpenSTAManager has an OS Command Injection in P7M File Processing
Affected: through 2.9.8.
- CVE-2025-69214High 8.7
OpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint)
Affected: through 2.9.8.
- CVE-2025-69216High 8.7
OpenSTAManager has an SQL Injection in Scadenzario Print Template
Affected: through 2.9.8.
- CVE-2026-24416High 8.7
OpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing Module
Affected: through 2.9.8.
- CVE-2026-24417High 8.7
OpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of Service
Affected: all versions.
- CVE-2026-24418High 8.7
OpenSTAManager has an SQL Injection vulnerability in the Scadenzario bulk operations module
Affected: through 2.9.8.
- CVE-2026-24419High 8.7
OpenSTAManager has an SQL Injection in the Prima Nota module
Affected: through 2.9.8.
- CVE-2025-69215High 8.7
OpenSTAManager has an SQL Injection in the Stampe Module
Affected: through 2.9.8.
Show all 17 advisoriesShow fewer advisories
- CVE-2025-69213High 8.7
OpenSTAManager has a SQL Injection in ajax_complete.php (get_sedi endpoint)
Affected: through 2.9.8.
- CVE-2025-65103High 8.8
OpenSTAManager has an authenticated SQL Injection vulnerability in API via 'display' parameter
Affected: fixed in 2.9.5.