CVE-2026-24415

CVE-2026-24415：OpenSTAManager 在 modificaiva.php 中受 righe 参数影响的 XSS 漏洞 概述 字段| 详情 ---|--- CVE ID| CVE-2026-24415 严重性| 中危 安全公告| 查看公告 发现者| Lukasz Rybak 受影响产品 devcode-it/openstamanager （版本：" $GET'righe' 参数未经任何使用 htmlspecialchars 或等效函数的过滤，被直接输出到 HTML value 属性中。这允许攻击者突破属性上下文并注入任意 HTML/JavaScript。 所有受影响文...

CVE-2026-24415 OpenSTAManager affected by reflected XSS in modifica_iva.php via righe parameter

OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contains Reflected XSS vulnerabilities in invoice/order/contract modification modals. The application fails to properly sanitize user-supplied input from the righe GET...

CVE-2026-24415

CVE-2026-24415 affects OpenSTAManager v2.9.8 and earlier, exposing multiple modules (contratti, preventivi, fatture, ddt, ordini, interventi) to Reflected XSS via the GET parameter righe in the modifica_iva.php modals. The vulnerability echoes $_GET['righe'] directly into HTML value attributes wi...