CVE-2026-38751Disclosure(devcode / openstamanager)

LOWCVSS 7.2 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Prioritize remediation for devcode openstamanager systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

OpenSTAManager version 2.10 and earlier contains an arbitrary file upload vulnerability in the module update functionality (modules/aggiornamenti/upload_modules.php)

devcode CVEs Back to dashboard

3.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-434

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

openstamanager

Threat summary

Public PoC and exploit tooling are both present
4 mentions across 3 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 1 signal
PoC mentioned or linked in 2 signals
Technical details provided in 3 signals
Disclosure: 2 classified signals
Peaked 2d ago at 2 mentions (2026-05-04); latest day: 1
4 total mentions across 3 days

Affected systems

Vendors

devcode

Products

openstamanager

Deep dive

Activity timeline4 mentions / 3d

Signal classification2 categories

Disclosure

250.0%

PoC

250.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-04	2	Disclosure2
2026-07-10	1	PoC1
2026-08-19	1	PoC1

Full discourse4 posts

WDNC@CareWeDoNot90d
PoC
CVE-2026-38751 Enigma.htb root after from http://127.0.0.1:1337/api/olivetin.api.v1.OliveTin/StartActionAndWait abuse https://t.co/2BHw94ps2I
Post summary
The tweet indicates CVE‑2026‑38751 can be abused via a specific API endpoint to obtain root, and it links to a resource that presumably contains proof‑of‑concept code.
00031101
337 followersView on X
b0ySie7e@B0ySie7e50d
PoC
OpenSTAManager ≤ 2.10 is vulnerable to an authenticated arbitrary file upload that allows an attacker to upload a malicious ZIP archive containing a PHP webshell. This PoC automates the process: https://github.com/b0ySie7e/OpenSTAManager-RCE-Exploit-CVE-2026-38751
Post summary
OpenSTAManager versions ≤ 2.10 suffer from an authenticated arbitrary file upload enabling PHP webshell injection, and a PoC exploit script is available on GitHub.
0001049
16 followersView on X
CVE@CVEnew156d
Disclosure
CVE-2026-38751 OpenSTAManager version 2.10 and earlier contains an arbitrary file upload vulnerability in the module update functionality (modules/aggiornamenti/upload_modules.php) https://www.cve.org/CVERecord?id=CVE-2026-38751
Post summary
OpenSTAManager versions 2.10 and earlier are vulnerable to arbitrary file upload via modules/aggiornamenti/upload_modules.php, as documented in CVE-2026-38751.
00010206
57.4K followersView on X
Infoflowcloud@infoflowcloud156d
Disclosure
🚨*CVE* CVE-2026-38751 OpenSTAManager version 2.10 and earlier contains an arbitrary file upload vulnerability in the module update functionality (modules/aggiornamenti/upload_modules.php) https://www.cve.org/CVERecord?id=CVE-2026-38751 ----- Traducción: CVE-2026-38751 OpenST… http://infoflow.cloud`
Post summary
An arbitrary file upload flaw (CVE-2026-38751) in OpenSTAManager v2.10 and earlier has been disclosed; no exploitation, patch, or PoC details are provided.
0000032
75 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	devcode	openstamanager	-	-	-

Explore more

Back to dashboard devcode CVEs openstamanager vulnerabilities