CVE-2025-69214: Devcode Openstamanager

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, an SQL Injection vulnerability exists in the ajax_select.php endpoint when handling the componenti operation. An authenticated attacker can inject malicious SQL code through the options[matricola] parameter.

Affected products

• Devcode Openstamanager: up to and including 2.9.8

Published 2026-02-06. Last modified 2026-06-17.