PT-2026-5968

Name of the Vulnerable Software and Affected Versions OpenSTAManager versions prior to 2.9.8 Description OpenSTAManager is a management software for technical assistance and invoicing. A SQL Injection issue exists in version 2.9.8 and earlier when handling the get sedi operation through the /ajax...

PT-2026-5969

Name of the Vulnerable Software and Affected Versions OpenSTAManager versions 2.9.8 and prior Description OpenSTAManager is an open source management software for technical assistance and invoicing. A SQL Injection vulnerability exists in the Stampe Module, specifically in the...

SQL Injection

devcode-it/openstamanager is vulnerable to a SQL Injection. The vulnerability is due to improper validation of the display parameter in the API, which allows an attacker to inject and execute arbitrary SQL queries to access, modify, or delete database data...

CVE-2025-65103

OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.9.5, an authenticated SQL Injection vulnerability in the API allows any user, regardless of permission level, to execute arbitrary SQL queries. By manipulating the display parameter in ...

GHSA-2JM2-2P35-RP3J OpenSTAManager has Authenticated SQL Injection in API via 'display' parameter

Summary An authenticated SQL Injection vulnerability in the API allows any user, regardless of permission level, to execute arbitrary SQL queries. By manipulating the display parameter in an API request, an attacker can exfiltrate, modify, or delete any data in the database, leading to a full...

EUVD-2025-198178

OpenSTAManager has Authenticated SQL Injection in API via 'display' parameter...

SQL Injection

Overview devcode-it/openstamanager is a management software for technical assistance and electronic invoicing Affected versions of this package are vulnerable to SQL Injection via the display parameter in API requests. An attacker can execute arbitrary SQL commands by supplying crafted input to t...

OpenSTAManager has Authenticated SQL Injection in API via 'display' parameter

Summary An authenticated SQL Injection vulnerability in the API allows any user, regardless of permission level, to execute arbitrary SQL queries. By manipulating the display parameter in an API request, an attacker can exfiltrate, modify, or delete any data in the database, leading to a full...

CVE-2025-65103

OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.9.5, an authenticated SQL Injection vulnerability in the API allows any user, regardless of permission level, to execute arbitrary SQL queries. By manipulating the display parameter in ...

CVE-2025-65103 OpenSTAManager has an authenticated SQL Injection vulnerability in API via 'display' parameter

OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.9.5, an authenticated SQL Injection vulnerability in the API allows any user, regardless of permission level, to execute arbitrary SQL queries. By manipulating the display parameter in ...

CVE-2025-65103 OpenSTAManager has an authenticated SQL Injection vulnerability in API via 'display' parameter

OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.9.5, an authenticated SQL Injection vulnerability in the API allows any user, regardless of permission level, to execute arbitrary SQL queries. By manipulating the display parameter in ...

CVE-2025-65103

OpenSTAManager vulnerable pre‑2.9.5 to authenticated SQL Injection via the API display parameter. Exploitation lets an authenticated user exfiltrate, modify, or delete arbitrary data, potentially compromising the full system. Patch is available in version 2.9.5 (and higher). Affected bundles: Ope...

OpenSTAManager SQL注入漏洞

OpenSTAManager is an open source management software for technical assistance and billing from Devcode Open Source. A SQL injection vulnerability exists in OpenSTAManager versions prior to 2.9.5. The vulnerability stems from a SQL injection in the API, which could cause an arbitrary user to execu...

PT-2025-47519

Name of the Vulnerable Software and Affected Versions OpenSTAManager versions prior to 2.9.5 Description OpenSTAManager is a management software for technical assistance and invoicing. A SQL Injection flaw exists in the API that allows authenticated users to execute arbitrary SQL queries,...

EUVD-2023-42645

Malicious code in bioql PyPI...

CVE-2023-38878

A reflected cross-site scripting XSS vulnerability in DevCode OpenSTAManager versions 2.4.24 to 2.4.47 may allow a remote attacker to execute arbitrary JavaScript in the web browser of a victim by injecting a malicious payload into the 'error' and 'errordescription' parameters of 'oauth2.php'...

Cross site scripting

A reflected cross-site scripting XSS vulnerability in DevCode OpenSTAManager versions 2.4.24 to 2.4.47 may allow a remote attacker to execute arbitrary JavaScript in the web browser of a victim by injecting a malicious payload into the 'error' and 'errordescription' parameters of 'oauth2.php'...

CVE-2023-38878

DevCode OpenSTAManager is affected by a reflected XSS in versions 2.4.24–2.4.47. The vulnerability arises from injecting malicious payloads into the error and error_description parameters of oauth2.php, allowing a remote attacker to execute JavaScript in a victim’s browser. Public documents do no...

DevCode OpenSTAManager Cross-Site Scripting Vulnerability

OpenSTAManager is an open source management software for technical assistance and billing from Devcode Open Source. A security vulnerability exists in DevCode OpenSTAManager versions 2.4.24 through 2.4.47, which stems from a reflected cross-site scripting XSS vulnerability in the error and...

CVE-2023-38878

A reflected cross-site scripting XSS vulnerability in DevCode OpenSTAManager versions 2.4.24 to 2.4.47 may allow a remote attacker to execute arbitrary JavaScript in the web browser of a victim by injecting a malicious payload into the 'error' and 'errordescription' parameters of 'oauth2.php'...