Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:composer/devcode-it/openstamanager@0.0.0
purl pkg:composer/devcode-it/openstamanager@0.0.0
Tags Ghost
Next non-vulnerable version 2.10.2
Latest non-vulnerable version 2.10.2
Risk 4.0
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-nzzy-h46k-bfcr
Aliases:
CVE-2026-24417
GHSA-4hc4-8599-xh2h
OpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of Service Critical Time-Based Blind SQL Injection vulnerability affecting **multiple search modules** in OpenSTAManager v2.9.8 allows authenticated attackers to extract sensitive database contents including password hashes, customer data, and financial records through time-based Boolean inference attacks with **amplified execution** across 10+ modules. **Status:** ✅ Confirmed and tested on live instance (v2.9.8) **Vulnerable Parameter:** `term` (GET) **Affected Endpoint:** `/ajax_search.php` **Affected Modules:** Articoli, Ordini, DDT, Fatture, Preventivi, Anagrafiche, Impianti, Contratti, Automezzi, Interventi There are no reported fixed by versions.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-02T04:49:59.970960+00:00 GitLab Importer Affected by VCID-nzzy-h46k-bfcr https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/devcode-it/openstamanager/CVE-2026-24417.yml 38.6.0