CVE-2026-28805

OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.10.2, multiple AJAX select handlers in OpenSTAManager are vulnerable to Time-Based Blind SQL Injection through the options[stato] GET parameter. The user-supplied value is read from $superselect['stato'] and concatenated directly into SQL WHERE clauses as a bare expression, without any sanitization, parameterization, or allowlist validation. An authenticated attacker can inject arbitrary SQL statements to extract sensitive data from the database, including usernames, password hashes, financial records, and any other information stored in the MySQL database. This issue has been patched in version 2.10.2.

• CWE-89

• https://github.com/devcode-it/openstamanager/commit/50b9089c506ba2ca249afb1dfead2af5d42c10e7Patch
• https://github.com/devcode-it/openstamanager/commit/679c40fa5b3acad4263b537f367c0695ff9666dcPatch
• https://github.com/devcode-it/openstamanager/releases/tag/v2.10.2Product, Release Notes
• https://github.com/devcode-it/openstamanager/security/advisories/GHSA-3gw8-3mg3-jmpcExploit, Mitigation, Vendor Advisory

Published

Apr 2, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-2880A vulnerability in @fastify/middie versions < 9.2.0 can resu…9.1
• CVE-2026-28800Natro Macro is an open-source Bee Swarm Simulator macro writ…8
• CVE-2026-28801Natro Macro is an open-source Bee Swarm Simulator macro writ…7.8
• CVE-2026-28802Authlib is a Python library which builds OAuth and OpenID Co…9.8
• CVE-2026-28803Open Forms allows users create and publish smart forms. Prio…6.5
• CVE-2026-28804pypdf is a free and open-source pure-python PDF library. Pri…5.3
• CVE-2026-28806Improper Authorization vulnerability in nerves-hub nerves_hu…8.8
• CVE-2026-28807Improper Limitation of a Pathname to a Restricted Directory …7.5
• CVE-2026-28808Incorrect Authorization vulnerability in Erlang OTP (inets m…9.8
• CVE-2026-28809XML External Entity (XXE) vulnerability in esaml (and its fo…5.3
• CVE-2026-2881A vulnerability has been found in D-Link DWR-M960 1.01.07. T…8.8
• CVE-2026-28810Generation of Predictable Numbers or Identifiers vulnerabili…3.7