{"items":[{"id":"CVE-2026-35470","published":"2026-04-06T17:40:32.973Z","updated":"2026-04-07T14:06:27.500Z","title":"OpenSTAManager has a SQL Injection via righe Parameter in confronta_righe Modals","severity":"HIGH","score":8.8,"vendor":"devcode-it","product":"openstamanager","kev":false,"epss":0.00423,"kevAdded":null},{"id":"CVE-2026-35168","published":"2026-04-02T13:48:16.626Z","updated":"2026-04-02T16:23:20.657Z","title":"OpenSTAManager: SQL Injection via Aggiornamenti Module","severity":"HIGH","score":8.8,"vendor":"devcode-it","product":"openstamanager","kev":false,"epss":0.0068,"kevAdded":null},{"id":"CVE-2026-28805","published":"2026-04-02T13:44:07.063Z","updated":"2026-04-02T18:31:08.958Z","title":"OpenSTAManager: Time-Based Blind SQL Injection via `options[stato]` Parameter","severity":"HIGH","score":8.8,"vendor":"devcode-it","product":"openstamanager","kev":false,"epss":0.00468,"kevAdded":null},{"id":"CVE-2026-29782","published":"2026-04-02T13:42:25.134Z","updated":"2026-04-03T19:52:52.158Z","title":"OpenSTAManager: Remote Code Execution via Insecure Deserialization in OAuth2","severity":"HIGH","score":7.2,"vendor":"devcode-it","product":"openstamanager","kev":false,"epss":0.00591,"kevAdded":null},{"id":"CVE-2026-27012","published":"2026-03-03T21:53:01.002Z","updated":"2026-03-04T21:21:34.908Z","title":"Unauthenticated privilege escalation in OpenSTAManager via modules/utenti/actions.php","severity":"CRITICAL","score":9.8,"vendor":"devcode-it","product":"openstamanager","kev":false,"epss":0.00598,"kevAdded":null},{"id":"CVE-2026-24415","published":"2026-03-03T21:51:41.971Z","updated":"2026-03-04T21:17:18.456Z","title":"OpenSTAManager affected by reflected XSS in modifica_iva.php via righe parameter","severity":"MEDIUM","score":5.1,"vendor":"devcode-it","product":"openstamanager","kev":false,"epss":0.00284,"kevAdded":null},{"id":"CVE-2025-69212","published":"2026-02-06T18:12:38.391Z","updated":"2026-02-09T15:29:00.443Z","title":"OpenSTAManager has an OS Command Injection in P7M File Processing","severity":"CRITICAL","score":9.4,"vendor":"devcode-it","product":"openstamanager","kev":false,"epss":0.01915,"kevAdded":null},{"id":"CVE-2025-69214","published":"2026-02-06T18:11:34.102Z","updated":"2026-02-09T15:29:08.194Z","title":"OpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint)","severity":"HIGH","score":8.7,"vendor":"devcode-it","product":"openstamanager","kev":false,"epss":0.0046,"kevAdded":null},{"id":"CVE-2025-69216","published":"2026-02-06T18:10:33.838Z","updated":"2026-02-09T15:29:13.943Z","title":"OpenSTAManager has an SQL Injection in Scadenzario Print Template","severity":"HIGH","score":8.7,"vendor":"devcode-it","product":"openstamanager","kev":false,"epss":0.00393,"kevAdded":null},{"id":"CVE-2026-24416","published":"2026-02-06T18:08:44.717Z","updated":"2026-02-09T15:29:19.281Z","title":"OpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing Module","severity":"HIGH","score":8.7,"vendor":"devcode-it","product":"openstamanager","kev":false,"epss":0.00406,"kevAdded":null},{"id":"CVE-2026-24417","published":"2026-02-06T18:07:52.247Z","updated":"2026-02-06T18:57:15.495Z","title":"OpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of Service","severity":"HIGH","score":8.7,"vendor":"devcode-it","product":"openstamanager","kev":false,"epss":0.00406,"kevAdded":null},{"id":"CVE-2026-24418","published":"2026-02-06T18:06:47.383Z","updated":"2026-02-06T18:48:34.264Z","title":"OpenSTAManager has an SQL Injection vulnerability in the Scadenzario bulk operations module","severity":"HIGH","score":8.7,"vendor":"devcode-it","product":"openstamanager","kev":false,"epss":0.00399,"kevAdded":null},{"id":"CVE-2026-24419","published":"2026-02-06T18:05:42.332Z","updated":"2026-02-06T18:30:09.396Z","title":"OpenSTAManager has an SQL Injection in the Prima Nota  module","severity":"HIGH","score":8.7,"vendor":"devcode-it","product":"openstamanager","kev":false,"epss":0.00382,"kevAdded":null},{"id":"CVE-2025-69215","published":"2026-02-04T17:42:31.964Z","updated":"2026-02-04T19:31:56.940Z","title":"OpenSTAManager has an SQL Injection in the Stampe Module","severity":"HIGH","score":8.7,"vendor":"devcode-it","product":"openstamanager","kev":false,"epss":0.00444,"kevAdded":null},{"id":"CVE-2025-69213","published":"2026-02-04T17:42:28.181Z","updated":"2026-02-04T19:32:47.018Z","title":"OpenSTAManager has a SQL Injection in ajax_complete.php (get_sedi endpoint)","severity":"HIGH","score":8.7,"vendor":"devcode-it","product":"openstamanager","kev":false,"epss":0.00453,"kevAdded":null},{"id":"CVE-2025-65103","published":"2025-11-19T19:09:09.209Z","updated":"2025-11-19T20:31:35.423Z","title":"OpenSTAManager has an authenticated SQL Injection vulnerability in API via 'display' parameter","severity":"HIGH","score":8.8,"vendor":"devcode-it","product":"openstamanager","kev":false,"epss":0.0037,"kevAdded":null}]}