CVE-2026-35470

OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to 2.10.2, confronta_righe.php files across different modules in OpenSTAManager contain an SQL Injection vulnerability. The righe parameter received via $_GET['righe'] is directly concatenated into an SQL query without any sanitization, parameterization or validation. An authenticated attacker can inject arbitrary SQL statements to extract sensitive data from the database, including user credentials, customer information, invoice data and any other stored data. This vulnerability is fixed in 2.10.2.

• CWE-89

• https://github.com/devcode-it/openstamanager/releases/tag/v2.10.2Product, Release Notes
• https://github.com/devcode-it/openstamanager/security/advisories/GHSA-mmm5-3g4x-qw39Exploit, Mitigation, Vendor Advisory
• https://github.com/devcode-it/openstamanager/security/advisories/GHSA-mmm5-3g4x-qw39Exploit, Mitigation, Vendor Advisory

Published

Apr 6, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-35465SecureDrop Client is a desktop app for journalists to secure…7.5
• CVE-2026-35466XSS vulnerability in cveInterface.js allows for inject HTML …6.1
• CVE-2026-35467The stored API keys in temporary browser client is not marke…7.5
• CVE-2026-35468nimiq/core-rs-albatross is a Rust implementation of the Nimi…7.5
• CVE-2026-35469spdystream is a Go library for multiplexing streams over SPD…8.7
• CVE-2026-3547Out-of-bounds read in ALPN parsing due to incomplete validat…7.5
• CVE-2026-35471goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-be…9.8
• CVE-2026-35472WeGIA is a Web manager for charitable institutions. Prior to…6.1
• CVE-2026-35473WeGIA is a Web manager for charitable institutions. Prior to…6.1
• CVE-2026-35474WeGIA is a Web manager for charitable institutions. Prior to…6.1
• CVE-2026-35475WeGIA is a Web manager for charitable institutions. Prior to…6.1
• CVE-2026-35476InvenTree is an Open Source Inventory Management System. Pri…4.3