VulnSocial

CVE-2026-35470General(devcode / openstamanager)

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch devcode openstamanager systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to 2.10.2, confronta_righe.php files across different modules in OpenSTAManager contain an SQL Injection vulnerability. The righe parameter received via $_GET['righe'] is directly concatenated into an SQL query without any sanitization, parameterization or validation. An authenticated attacker can inject arbitrary SQL statements to extract sensitive data from the database, including user credentials, customer information, invoice data and any other stored data. This vulnerability is fixed in 2.10.2.

devcode CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Exploit / PoC references
Other references
Weakness type (CWE)
CWE-89

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • openstamanager

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • General: 1 classified signal
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 2 mentions (2026-04-06); latest day: 1
  • 3 total mentions across 2 days

Affected systems

Vendors
devcode
Products
openstamanager

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-04-06: 2Mentions · 2026-04-07: 1Patch / Workaround · 2026-04-06: 1Technical Details · 2026-04-06: 1Technical Details · 2026-04-07: 104-0604-07
Signal classification3 categories
General
133.3%
Patch
133.3%
Disclosure
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-04-062
General1Patch1
2026-04-071
Disclosure1
Full discourse3 posts
  • CVEFind.com@CveFindCom
    Patch

    [CVE-2026-35470: HIGH] Attention users! OpenSTAManager prior to 2.10.2 is vulnerable to SQL Injection in confronta_righe.php. Ensure your system is updated to the latest version to avoid potential cyber secu...#cve,CVE-2026-35470,#cybersecurity https://cvefind.com/CVE-2026-35470

    Post summary

    CVE‑2026‑35470 allows SQL injection in OpenSTAManager versions before 2.10.2; users are advised to update to the latest version to mitigate the vulnerability.

    0001036
    619 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-35470 SQL Injection in OpenSTAManager Prior to 2.10.2 via confronta_righe.php https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-35470

    Post summary

    The text announces a new SQL Injection vulnerability in OpenSTAManager (before version 2.10.2) via the confronta_righe.php file, providing basic technical details but no PoC, exploit code, or patch information.

    0000050
    4.0K followersView on X
  • CVE@CVEnew
    General

    CVE-2026-35470 OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to 2.10.2, confronta_righe.php files across different modules in Op… https://www.cve.org/CVERecord?id=CVE-2026-35470

    Post summary

    The excerpt references CVE-2026-35470 for OpenSTAManager, but provides only a brief mention of affected files and a link to the CVE record without deeper technical or operational details.

    0000088
    57.0K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appdevcodeopenstamanager---

Explore more

Back to dashboarddevcode CVEsopenstamanager vulnerabilities