Home / Vulnerability Intelligence / CVE-2026-35470

CVE-2026-35470 - Vulnerability Analysis

HighCVSS: 8.8

Last Updated: April 6, 2026

OpenSTAManager - SQL Injection

Published: April 6, 2026Updated: April 6, 2026Remote Exploitable

Overview

OpenSTAManager < 2.10.2 contains an SQL injection caused by unsanitized 'righe' parameter in confronta_righe.php files, letting authenticated attackers extract sensitive database information, exploit requires authentication.

Severity & Score

Severity: High

CVSS Score: 8.8

Impact

Authenticated attackers can extract sensitive database information including user credentials and invoice data.

Mitigation

Update to version 2.10.2 or later.

References

https://github.com/devcode-it/openstamanager/releases/tag/v2.10.2
https://github.com/devcode-it/openstamanager/security/advisories/GHSA-mmm5-3g4x-qw39

Related Resources

Vulnerability Intelligence Dashboard
Credential Scanner

Details

CVE ID: CVE-2026-35470
Severity: High
CVSS Score: 8.8
Type: sql_injection
Status: new

CWE

CWE-89

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H