Composer devcode-it/openstamanager has 18 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2025-69212 | OpenSTAManager has an OS Command Injection in P7M File Processing | critical | 0.0 | <=2.9.8 | – |
| CVE-2026-35168 | OpenSTAManager: SQL Injection via Aggiornamenti Module | high | 8.8 | <2.10.2 | 2.10.2 |
| CVE-2026-29782 | OpenSTAManager Affected by Remote Code Execution via Insecure Deserialization in OAuth2 | high | 7.2 | <2.10.2 | 2.10.2 |
| CVE-2026-27012 | OpenSTAManager affected by unauthenticated privilege escalation via modules/utenti/actions.php | critical | 9.8 | <=2.9.8 | – |
| CVE-2025-69214 | OpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint) | high | 8.8 | <=2.9.8 | – |
| CVE-2026-38751 | OpenSTAManager contains an arbitrary file upload vulnerability in its module update functionality | high | 7.2 | <=2.10-beta | – |
| CVE-2026-28805 | OpenSTAManager has a Time-Based Blind SQL Injection via `options[stato]` Parameter | high | 8.8 | <2.10.2 | 2.10.2 |
| CVE-2025-69213 | OpenSTAManager has a SQL Injection in ajax_complete.php (get_sedi endpoint) | high | 0.0 | <=2.9.8 | – |
| CVE-2025-69215 | OpenSTAManager has an SQL Injection in the Stampe Module | high | 0.0 | <=2.9.8 | – |
| CVE-2026-35470 | OpenSTAManager has a SQL Injection via righe Parameter in confronta_righe Modals | high | 8.8 | <2.10.2 | 2.10.2 |
| CVE-2026-24416 | OpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing Module | high | 0.0 | <=2.9.8 | – |
| CVE-2026-24417 | OpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of Service | high | 0.0 | all versions | – |
| CVE-2026-24418 | OpenSTAManager has a SQL Injection vulnerability in the Scadenzario bulk operations module | high | 0.0 | <=2.9.8 | – |
| CVE-2025-69216 | OpenSTAManager has a SQL Injection in Scadenzario Print Template | high | 0.0 | <=2.9.8 | – |
| CVE-2026-24419 | OpenSTAManager has a SQL Injection in the Prima Nota module | high | 0.0 | <=2.9.8 | – |
| CVE-2025-65103 | OpenSTAManager has Authenticated SQL Injection in API via 'display' parameter | high | 8.8 | <2.9.5 | 2.9.5 |
| CVE-2026-24415 | OpenSTAManager Affected by XSS in modifica_iva.php via righe parameter | medium | 0.0 | <2.9.8 | 2.9.8 |
| CVE-2026-44701 | OpenSTAManager has HTML Injection in modules/utenti/edit.php | low | 3.5 | <2.11-beta | 2.11-beta |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked