CVE-2026-24415 - Vulnerability Analysis

Overview

OpenSTAManager <= 2.9.8 contains a reflected XSS caused by improper sanitization of the 'righe' GET parameter in invoice/order/contract modification modals, letting attackers inject arbitrary HTML/JavaScript remotely, exploit requires crafted request.

Severity & Score

Impact

Attackers can execute arbitrary scripts in users' browsers, potentially stealing session data or performing actions on behalf of users.

Mitigation

Update to a version later than 2.9.8 or apply proper input sanitization using htmlspecialchars() or equivalent.

References

• https://github.com/devcode-it/openstamanager/security/advisories/GHSA-jfgp-g7x7-j25j

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner