Devcode-it Openstamanager vulnerabilities

• devcode openstamanager OpenSTAManager has a SQL Injection via righe Parameter in confronta_righe Modals CVE-2026-35470 Fix available 8.8 HighApril 3, 2026
• devcode openstamanager OpenSTAManager: SQL Injection via Aggiornamenti Module CVE-2026-35168 Fix available 8.8 HighApril 2, 2026
• devcode openstamanager OpenSTAManager: Remote Code Execution via Insecure Deserialization in OAuth2 CVE-2026-29782 Public exploitFix available 7.2 HighApril 1, 2026
• devcode openstamanager OpenSTAManager: Time-Based Blind SQL Injection via `options[stato]` Parameter CVE-2026-28805 Fix available 8.8 HighApril 1, 2026
• devcode openstamanager Unauthenticated privilege escalation in OpenSTAManager via modules/utenti/actions.php CVE-2026-27012 9.8 CriticalMarch 3, 2026
• devcode openstamanager OpenSTAManager affected by reflected XSS in modifica_iva.php via righe parameter CVE-2026-24415 Public exploitFix available 5.1 MediumMarch 3, 2026
• devcode openstamanager OpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing Module CVE-2026-24416 Public exploit 8.7 HighFebruary 6, 2026
• devcode openstamanager OpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of Service CVE-2026-24417 Public exploitFix available 8.7 HighFebruary 6, 2026
• devcode openstamanager OpenSTAManager has an SQL Injection vulnerability in the Scadenzario bulk operations module CVE-2026-24418 Public exploit 8.7 HighFebruary 6, 2026
• devcode openstamanager OpenSTAManager has an SQL Injection in Scadenzario Print Template CVE-2025-69216 Public exploit 8.7 HighFebruary 6, 2026
• devcode openstamanager OpenSTAManager has an SQL Injection in the Prima Nota module CVE-2026-24419 Public exploit 8.7 HighFebruary 6, 2026
• devcode openstamanager OpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint) CVE-2025-69214 Public exploit 8.7 HighFebruary 6, 2026
• devcode openstamanager OpenSTAManager has an OS Command Injection in P7M File Processing CVE-2025-69212 Public exploit 9.4 CriticalFebruary 6, 2026
• devcode openstamanager OpenSTAManager has an SQL Injection in the Stampe Module CVE-2025-69215 Public exploit 8.7 HighFebruary 3, 2026
• devcode openstamanager OpenSTAManager has a SQL Injection in ajax_complete.php (get_sedi endpoint) CVE-2025-69213 Public exploit 8.7 HighFebruary 3, 2026
• devcode-it openstamanager OpenSTAManager has an authenticated SQL Injection vulnerability in API via 'display' parameter CVE-2025-65103 Fix available 8.8 HighNovember 19, 2025