Search for vulnerabilities
| Vulnerability ID | VCID-81kx-rj8c-dkbr |
| Aliases |
CVE-2026-24419
GHSA-4j2x-jh4m-fqv6 |
| Summary | OpenSTAManager has a SQL Injection in the Prima Nota module Critical Error-Based SQL Injection vulnerability in the Prima Nota (Journal Entry) module of OpenSTAManager v2.9.8 allows authenticated attackers to extract complete database contents including user credentials, customer PII, and financial records through XML error messages by injecting malicious SQL into URL parameters. **Status:** ✅ Confirmed and tested on live instance (v2.9.8) **Vulnerable Parameters:** `id_documenti` (GET parameters) **Affected Endpoint:** `/modules/primanota/add.php` **Attack Type:** Error-Based SQL Injection (IN clause) |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 8.0 |
| Risk | 4.0 |
| Affected and Fixed Packages | Package Details |
| System | Score | Found at |
|---|---|---|
| cvssv4 | 8.7 | https://github.com/devcode-it/openstamanager |
| generic_textual | HIGH | https://github.com/devcode-it/openstamanager |
| cvssv4 | 8.7 | https://github.com/devcode-it/openstamanager/security/advisories/GHSA-4j2x-jh4m-fqv6 |
| generic_textual | HIGH | https://github.com/devcode-it/openstamanager/security/advisories/GHSA-4j2x-jh4m-fqv6 |
| cvssv4 | 8.7 | https://nvd.nist.gov/vuln/detail/CVE-2026-24419 |
| generic_textual | HIGH | https://nvd.nist.gov/vuln/detail/CVE-2026-24419 |
| Reference id | Reference type | URL |
|---|---|---|
| https://github.com/devcode-it/openstamanager | ||
| CVE-2026-24419 | https://nvd.nist.gov/vuln/detail/CVE-2026-24419 | |
| GHSA-4j2x-jh4m-fqv6 | https://github.com/advisories/GHSA-4j2x-jh4m-fqv6 | |
| GHSA-4j2x-jh4m-fqv6 | https://github.com/devcode-it/openstamanager/security/advisories/GHSA-4j2x-jh4m-fqv6 |
| Attack Vector (AV) | Attack Complexity (AC) | Attack Requirements (AT) | Privileges Required (PR) | User Interaction (UI) | Vulnerable System Impact Confidentiality (VC) | Vulnerable System Impact Integrity (VI) | Vulnerable System Impact Availability (VA) | Subsequent System Impact Confidentiality (SC) | Subsequent System Impact Integrity (SI) | Subsequent System Impact Availability (SA) |
|---|---|---|---|---|---|---|---|---|---|---|
network adjacent local physical |
low high |
none present |
none low high |
none passive active |
high low none |
high low none |
high low none |
high low none |
high low none |
high low none |
| Attack Vector (AV) | Attack Complexity (AC) | Attack Requirements (AT) | Privileges Required (PR) | User Interaction (UI) | Vulnerable System Impact Confidentiality (VC) | Vulnerable System Impact Integrity (VI) | Vulnerable System Impact Availability (VA) | Subsequent System Impact Confidentiality (SC) | Subsequent System Impact Integrity (SI) | Subsequent System Impact Availability (SA) |
|---|---|---|---|---|---|---|---|---|---|---|
network adjacent local physical |
low high |
none present |
none low high |
none passive active |
high low none |
high low none |
high low none |
high low none |
high low none |
high low none |
| Attack Vector (AV) | Attack Complexity (AC) | Attack Requirements (AT) | Privileges Required (PR) | User Interaction (UI) | Vulnerable System Impact Confidentiality (VC) | Vulnerable System Impact Integrity (VI) | Vulnerable System Impact Availability (VA) | Subsequent System Impact Confidentiality (SC) | Subsequent System Impact Integrity (SI) | Subsequent System Impact Availability (SA) |
|---|---|---|---|---|---|---|---|---|---|---|
network adjacent local physical |
low high |
none present |
none low high |
none passive active |
high low none |
high low none |
high low none |
high low none |
high low none |
high low none |
No EPSS data available for this vulnerability.
| Date | Actor | Action | Source | VulnerableCode Version |
|---|---|---|---|---|
| 2026-06-02T04:50:00.441846+00:00 | GitLab Importer | Import | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/devcode-it/openstamanager/CVE-2026-24419.yml | 38.6.0 |