Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, a critical OS Command Injection vulnerability exists in the P7M (signed XML) file decoding functionality. An authenticated attacker can upload a ZIP file containing a .p7m file with a malicious filename to execute arbitrary system commands on the server.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-02-06 | 2 | Disclosure2 |
| 2026-02-07 | 1 | General1 |
CVE-2025-69212 OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, a critical OS Command Injection vulnerability exist… https://www.cve.org/CVERecord?id=CVE-2025-69212
Post summary
The post announces a critical OS Command Injection vulnerability affecting OpenSTAManager 2.9.8 and earlier, but provides no PoC, exploit, or patch details.
OpenSTAManager is affected by an OS Command Injection (CVE-2025-69212) during P7M file processing. Review input handling and restrict access. #OpenSTAManager #infosec #RCE https://www.pulsepatch.io/posts/cve-2025-69212-openstamanager-os-command-injection
Post summary
The post briefly notes an OS command injection vulnerability (CVE-2025-69212) affecting OpenSTAManager, without providing exploitation details, a PoC, or remediation guidance.
🚨 CVE-2025-69212: OpenSTAManager has an OS Command... Command injection via malicious P7M filenames in OpenSTAManager bypasses input sanitization, enabling server takeover w... https://zerodaysignal.com/vulnerability/CVE-2025-69212 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
A newly disclosed OS command injection vulnerability (CVE-2025-69212) in OpenSTAManager allows attackers to take over the server using malicious P7M filenames.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | devcode | openstamanager | - | - | - |