openstamanager

Every one of the 16 is a mark on the map. Named now: 1 to 16, most at risk first.

1. OpenSTAManager has an OS Command Injection in P7M File ProcessingCVE-2025-69212devcode-it · CVSS 9.4 · 1.9% likely

   CWE-78

2. OpenSTAManager: SQL Injection via Aggiornamenti ModuleCVE-2026-35168devcode-it · CVSS 8.8 · 0.7% likely

   CWE-89

3. Unauthenticated privilege escalation in OpenSTAManager via modules/utenti/actions.phpCVE-2026-27012devcode-it · CVSS 9.8 · 0.6% likely

   CWE-306

4. OpenSTAManager: Remote Code Execution via Insecure Deserialization in OAuth2CVE-2026-29782devcode-it · CVSS 7.2 · 0.6% likely

   CWE-502

5. OpenSTAManager: Time-Based Blind SQL Injection via `options[stato]` ParameterCVE-2026-28805devcode-it · CVSS 8.8 · 0.5% likely

   CWE-89

6. OpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint)CVE-2025-69214devcode-it · CVSS 8.7 · 0.5% likely

   CWE-89

7. OpenSTAManager has a SQL Injection in ajax_complete.php (get_sedi endpoint)CVE-2025-69213devcode-it · CVSS 8.7 · 0.5% likely

   CWE-89

8. OpenSTAManager has an SQL Injection in the Stampe ModuleCVE-2025-69215devcode-it · CVSS 8.7 · 0.4% likely

   CWE-89

9. OpenSTAManager has a SQL Injection via righe Parameter in confronta_righe ModalsCVE-2026-35470devcode-it · CVSS 8.8 · 0.4% likely

   CWE-89

10. OpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of ServiceCVE-2026-24417devcode-it · CVSS 8.7 · 0.4% likely

    CWE-89

11. OpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing ModuleCVE-2026-24416devcode-it · CVSS 8.7 · 0.4% likely

    CWE-89

12. OpenSTAManager has an SQL Injection vulnerability in the Scadenzario bulk operations moduleCVE-2026-24418devcode-it · CVSS 8.7 · 0.4% likely

    CWE-89

13. OpenSTAManager has an SQL Injection in Scadenzario Print TemplateCVE-2025-69216devcode-it · CVSS 8.7 · 0.4% likely

    CWE-89

14. OpenSTAManager has an SQL Injection in the Prima Nota moduleCVE-2026-24419devcode-it · CVSS 8.7 · 0.4% likely

    CWE-89

15. OpenSTAManager has an authenticated SQL Injection vulnerability in API via 'display' parameterCVE-2025-65103devcode-it · CVSS 8.8 · 0.4% likely

    CWE-89

16. OpenSTAManager affected by reflected XSS in modifica_iva.php via righe parameterCVE-2026-24415devcode-it · CVSS 5.1 · 0.3% likely

    CWE-79

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.