{"schema_version":1,"title":"devcode-it/openstamanager (Packagist) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 18 vulnerabilities in devcode-it/openstamanager (Packagist): 0 in the last 7 days and 1 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-44701, was published on 26 August 2026.","url":"https://junglewise.ai/threats/technologies/devcode-it-openstamanager","json_url":"https://junglewise.ai/threats/technologies/devcode-it-openstamanager.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/devcode-it-openstamanager","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":2,"all_time":18,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":1,"last_365_days":18},"latest":[{"cve":"CVE-2026-44701","cvss":3.5,"slug":"cve-2026-44701-openstamanager-html-injection-in-group-name","title":"OpenSTAManager HTML injection in group name","severity":"low","exploited":false,"published_at":"2026-08-26T18:12:25+00:00","url":"https://junglewise.ai/threats/cve-2026-44701-openstamanager-html-injection-in-group-name"},{"cve":"CVE-2026-38751","cvss":7.2,"epss":0.0053,"slug":"cve-2026-38751-openstamanager-arbitrary-file-upload-in-module-update","title":"OpenSTAManager arbitrary file upload in module update functionality","severity":"high","exploited":false,"published_at":"2026-05-04T19:16:03.613+00:00","url":"https://junglewise.ai/threats/cve-2026-38751-openstamanager-arbitrary-file-upload-in-module-update"},{"cve":"CVE-2026-35470","cvss":8.8,"epss":0.0049,"slug":"cve-2026-35470-devcode-it-openstamanager-sql-injection-in-confronta-righe-php","title":"devcode-it OpenSTAManager SQL injection in confronta_righe.php","severity":"high","exploited":false,"published_at":"2026-04-06T18:16:44.4+00:00","url":"https://junglewise.ai/threats/cve-2026-35470-devcode-it-openstamanager-sql-injection-in-confronta-righe-php"},{"cve":"CVE-2026-35168","cvss":3.1,"epss":0.0081,"slug":"cve-2026-35168-openstamanager-sql-injection-via-aggiornamenti-module","title":"OpenSTAManager: SQL Injection via Aggiornamenti Module","severity":"low","exploited":false,"published_at":"2026-04-03T03:47:37+00:00","url":"https://junglewise.ai/threats/cve-2026-35168-openstamanager-sql-injection-via-aggiornamenti-module"},{"cve":"CVE-2026-29782","cvss":3.1,"epss":0.0069,"slug":"cve-2026-29782-openstamanager-affected-by-remote-code-execution-via-insecure","title":"OpenSTAManager Affected by Remote Code Execution via Insecure Deserialization in OAuth2","severity":"low","exploited":false,"published_at":"2026-04-01T19:46:50+00:00","url":"https://junglewise.ai/threats/cve-2026-29782-openstamanager-affected-by-remote-code-execution-via-insecure"},{"cve":"CVE-2026-28805","cvss":3.1,"epss":0.0054,"slug":"cve-2026-28805-openstamanager-has-a-time-based-blind-sql-injection-via-options","title":"OpenSTAManager has a Time-Based Blind SQL Injection via `options[stato]` Parameter","severity":"low","exploited":false,"published_at":"2026-04-01T19:46:00+00:00","url":"https://junglewise.ai/threats/cve-2026-28805-openstamanager-has-a-time-based-blind-sql-injection-via-options"},{"cve":"CVE-2026-27012","cvss":3.1,"epss":0.0065,"slug":"cve-2026-27012-openstamanager-affected-by-unauthenticated-privilege-escalation","title":"OpenSTAManager affected by unauthenticated privilege escalation via modules/utenti/actions.php","severity":"low","exploited":false,"published_at":"2026-03-03T17:43:49+00:00","url":"https://junglewise.ai/threats/cve-2026-27012-openstamanager-affected-by-unauthenticated-privilege-escalation"},{"cve":"CVE-2026-24415","cvss":4,"epss":0.0025,"slug":"cve-2026-24415-openstamanager-affected-by-xss-in-modifica-iva-php-via-righe","title":"OpenSTAManager Affected by XSS in modifica_iva.php via righe parameter","severity":"medium","exploited":false,"published_at":"2026-03-03T17:39:00+00:00","url":"https://junglewise.ai/threats/cve-2026-24415-openstamanager-affected-by-xss-in-modifica-iva-php-via-righe"},{"cve":"CVE-2026-24419","cvss":4,"epss":0.0037,"slug":"cve-2026-24419-openstamanager-has-a-sql-injection-in-the-prima-nota-module","title":"OpenSTAManager has a SQL Injection in the Prima Nota module","severity":"medium","exploited":false,"published_at":"2026-02-06T18:25:55+00:00","url":"https://junglewise.ai/threats/cve-2026-24419-openstamanager-has-a-sql-injection-in-the-prima-nota-module"},{"cve":"CVE-2026-24418","cvss":4,"epss":0.0038,"slug":"cve-2026-24418-openstamanager-has-a-sql-injection-vulnerability-in-the","title":"OpenSTAManager has a SQL Injection vulnerability in the Scadenzario bulk operations module","severity":"medium","exploited":false,"published_at":"2026-02-06T18:24:10+00:00","url":"https://junglewise.ai/threats/cve-2026-24418-openstamanager-has-a-sql-injection-vulnerability-in-the"},{"cve":"CVE-2026-24417","cvss":4,"epss":0.0039,"slug":"cve-2026-24417-openstamanager-has-a-time-based-blind-sql-injection-with","title":"OpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of Service","severity":"medium","exploited":false,"published_at":"2026-02-06T18:23:14+00:00","url":"https://junglewise.ai/threats/cve-2026-24417-openstamanager-has-a-time-based-blind-sql-injection-with"},{"cve":"CVE-2026-24416","cvss":4,"epss":0.0039,"slug":"cve-2026-24416-openstamanager-has-a-time-based-blind-sql-injection-in-article","title":"OpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing Module","severity":"medium","exploited":false,"published_at":"2026-02-06T18:19:51+00:00","url":"https://junglewise.ai/threats/cve-2026-24416-openstamanager-has-a-time-based-blind-sql-injection-in-article"},{"cve":"CVE-2025-69216","cvss":4,"epss":0.0038,"slug":"cve-2025-69216-openstamanager-has-a-sql-injection-in-scadenzario-print-template","title":"OpenSTAManager has a SQL Injection in Scadenzario Print Template","severity":"medium","exploited":false,"published_at":"2026-02-06T18:06:13+00:00","url":"https://junglewise.ai/threats/cve-2025-69216-openstamanager-has-a-sql-injection-in-scadenzario-print-template"},{"cve":"CVE-2025-69214","cvss":3.1,"epss":0.0044,"slug":"cve-2025-69214-openstamanager-has-a-sql-injection-in-ajax-select-php-componenti","title":"OpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint)","severity":"low","exploited":false,"published_at":"2026-02-06T18:04:32+00:00","url":"https://junglewise.ai/threats/cve-2025-69214-openstamanager-has-a-sql-injection-in-ajax-select-php-componenti"},{"cve":"CVE-2025-69212","cvss":4,"epss":0.0201,"slug":"cve-2025-69212-openstamanager-has-an-os-command-injection-in-p7m-file-processing","title":"OpenSTAManager has an OS Command Injection in P7M File Processing","severity":"medium","exploited":false,"published_at":"2026-02-06T17:59:37+00:00","url":"https://junglewise.ai/threats/cve-2025-69212-openstamanager-has-an-os-command-injection-in-p7m-file-processing"},{"cve":"CVE-2025-69215","cvss":4,"epss":0.004,"slug":"cve-2025-69215-openstamanager-has-an-sql-injection-in-the-stampe-module","title":"OpenSTAManager has an SQL Injection in the Stampe Module","severity":"medium","exploited":false,"published_at":"2026-02-03T19:01:46+00:00","url":"https://junglewise.ai/threats/cve-2025-69215-openstamanager-has-an-sql-injection-in-the-stampe-module"},{"cve":"CVE-2025-69213","cvss":4,"epss":0.0041,"slug":"cve-2025-69213-openstamanager-has-a-sql-injection-in-ajax-complete-php-get-sedi","title":"OpenSTAManager has a SQL Injection in ajax_complete.php (get_sedi endpoint)","severity":"medium","exploited":false,"published_at":"2026-02-03T18:44:17+00:00","url":"https://junglewise.ai/threats/cve-2025-69213-openstamanager-has-a-sql-injection-in-ajax-complete-php-get-sedi"},{"cve":"CVE-2025-65103","cvss":3.1,"epss":0.0035,"slug":"cve-2025-65103-openstamanager-has-authenticated-sql-injection-in-api-via-display","title":"OpenSTAManager has Authenticated SQL Injection in API via 'display' parameter","severity":"low","exploited":false,"published_at":"2025-11-19T21:00:37+00:00","url":"https://junglewise.ai/threats/cve-2025-65103-openstamanager-has-authenticated-sql-injection-in-api-via-display"}],"weekly":[{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"wwbn/avideo (Packagist)","slug":"wwbn-avideo","vulnerabilities":169,"url":"https://junglewise.ai/threats/technologies/wwbn-avideo"},{"name":"getgrav/grav (Packagist)","slug":"getgrav-grav","vulnerabilities":144,"url":"https://junglewise.ai/threats/technologies/getgrav-grav"},{"name":"thorsten/phpmyfaq (Packagist)","slug":"thorsten-phpmyfaq","vulnerabilities":138,"url":"https://junglewise.ai/threats/technologies/thorsten-phpmyfaq"},{"name":"pimcore/pimcore (Packagist)","slug":"pimcore-pimcore","vulnerabilities":136,"url":"https://junglewise.ai/threats/technologies/pimcore-pimcore"},{"name":"dolibarr/dolibarr (Packagist)","slug":"dolibarr-dolibarr","vulnerabilities":125,"url":"https://junglewise.ai/threats/technologies/dolibarr-dolibarr"},{"name":"drupal/core (Packagist)","slug":"packagist-drupal-core","vulnerabilities":116,"url":"https://junglewise.ai/threats/technologies/packagist-drupal-core"},{"name":"librenms/librenms (Packagist)","slug":"librenms-librenms","vulnerabilities":113,"url":"https://junglewise.ai/threats/technologies/librenms-librenms"},{"name":"microweber/microweber (Packagist)","slug":"microweber-microweber","vulnerabilities":106,"url":"https://junglewise.ai/threats/technologies/microweber-microweber"},{"name":"concrete5/concrete5 (Packagist)","slug":"concrete5-concrete5","vulnerabilities":93,"url":"https://junglewise.ai/threats/technologies/concrete5-concrete5"},{"name":"craftcms/cms (Packagist)","slug":"craftcms-cms","vulnerabilities":90,"url":"https://junglewise.ai/threats/technologies/craftcms-cms"},{"name":"snipe/snipe-it (Packagist)","slug":"snipe-snipe-it","vulnerabilities":80,"url":"https://junglewise.ai/threats/technologies/snipe-snipe-it"},{"name":"phpmyfaq/phpmyfaq (Packagist)","slug":"phpmyfaq-phpmyfaq","vulnerabilities":75,"url":"https://junglewise.ai/threats/technologies/phpmyfaq-phpmyfaq"}],"technology":{"hub":true,"name":"devcode-it/openstamanager (Packagist)","slug":"devcode-it-openstamanager","vendor":{"name":"Packagist","slug":"packagist","url":"https://junglewise.ai/threats/vendors/packagist"},"aliases":[],"description":"Open-source management software for service providers offering ticketing, invoicing, and customer management functionality.","url":"https://junglewise.ai/threats/technologies/devcode-it-openstamanager"},"most_severe":[{"cve":"CVE-2026-35470","cvss":8.8,"epss":0.0049,"slug":"cve-2026-35470-devcode-it-openstamanager-sql-injection-in-confronta-righe-php","title":"devcode-it OpenSTAManager SQL injection in confronta_righe.php","severity":"high","exploited":false,"published_at":"2026-04-06T18:16:44.4+00:00","url":"https://junglewise.ai/threats/cve-2026-35470-devcode-it-openstamanager-sql-injection-in-confronta-righe-php"},{"cve":"CVE-2026-38751","cvss":7.2,"epss":0.0053,"slug":"cve-2026-38751-openstamanager-arbitrary-file-upload-in-module-update","title":"OpenSTAManager arbitrary file upload in module update functionality","severity":"high","exploited":false,"published_at":"2026-05-04T19:16:03.613+00:00","url":"https://junglewise.ai/threats/cve-2026-38751-openstamanager-arbitrary-file-upload-in-module-update"},{"cve":"CVE-2025-69212","cvss":4,"epss":0.0201,"slug":"cve-2025-69212-openstamanager-has-an-os-command-injection-in-p7m-file-processing","title":"OpenSTAManager has an OS Command Injection in P7M File Processing","severity":"medium","exploited":false,"published_at":"2026-02-06T17:59:37+00:00","url":"https://junglewise.ai/threats/cve-2025-69212-openstamanager-has-an-os-command-injection-in-p7m-file-processing"},{"cve":"CVE-2025-69213","cvss":4,"epss":0.0041,"slug":"cve-2025-69213-openstamanager-has-a-sql-injection-in-ajax-complete-php-get-sedi","title":"OpenSTAManager has a SQL Injection in ajax_complete.php (get_sedi endpoint)","severity":"medium","exploited":false,"published_at":"2026-02-03T18:44:17+00:00","url":"https://junglewise.ai/threats/cve-2025-69213-openstamanager-has-a-sql-injection-in-ajax-complete-php-get-sedi"},{"cve":"CVE-2025-69215","cvss":4,"epss":0.004,"slug":"cve-2025-69215-openstamanager-has-an-sql-injection-in-the-stampe-module","title":"OpenSTAManager has an SQL Injection in the Stampe Module","severity":"medium","exploited":false,"published_at":"2026-02-03T19:01:46+00:00","url":"https://junglewise.ai/threats/cve-2025-69215-openstamanager-has-an-sql-injection-in-the-stampe-module"},{"cve":"CVE-2026-24417","cvss":4,"epss":0.0039,"slug":"cve-2026-24417-openstamanager-has-a-time-based-blind-sql-injection-with","title":"OpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of Service","severity":"medium","exploited":false,"published_at":"2026-02-06T18:23:14+00:00","url":"https://junglewise.ai/threats/cve-2026-24417-openstamanager-has-a-time-based-blind-sql-injection-with"},{"cve":"CVE-2026-24416","cvss":4,"epss":0.0039,"slug":"cve-2026-24416-openstamanager-has-a-time-based-blind-sql-injection-in-article","title":"OpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing Module","severity":"medium","exploited":false,"published_at":"2026-02-06T18:19:51+00:00","url":"https://junglewise.ai/threats/cve-2026-24416-openstamanager-has-a-time-based-blind-sql-injection-in-article"},{"cve":"CVE-2026-24418","cvss":4,"epss":0.0038,"slug":"cve-2026-24418-openstamanager-has-a-sql-injection-vulnerability-in-the","title":"OpenSTAManager has a SQL Injection vulnerability in the Scadenzario bulk operations module","severity":"medium","exploited":false,"published_at":"2026-02-06T18:24:10+00:00","url":"https://junglewise.ai/threats/cve-2026-24418-openstamanager-has-a-sql-injection-vulnerability-in-the"},{"cve":"CVE-2025-69216","cvss":4,"epss":0.0038,"slug":"cve-2025-69216-openstamanager-has-a-sql-injection-in-scadenzario-print-template","title":"OpenSTAManager has a SQL Injection in Scadenzario Print Template","severity":"medium","exploited":false,"published_at":"2026-02-06T18:06:13+00:00","url":"https://junglewise.ai/threats/cve-2025-69216-openstamanager-has-a-sql-injection-in-scadenzario-print-template"},{"cve":"CVE-2026-24419","cvss":4,"epss":0.0037,"slug":"cve-2026-24419-openstamanager-has-a-sql-injection-in-the-prima-nota-module","title":"OpenSTAManager has a SQL Injection in the Prima Nota module","severity":"medium","exploited":false,"published_at":"2026-02-06T18:25:55+00:00","url":"https://junglewise.ai/threats/cve-2026-24419-openstamanager-has-a-sql-injection-in-the-prima-nota-module"}],"generated_at":"2026-09-28T03:07:00.154823+00:00"}