CVE-2025-69213CWE-89

OpenSTAManager has a SQL Injection in ajax_complete.php (get_sedi endpoint)

High · published February 4, 2026

CVSS v4.0
8.7
EPSS
0%
Percentile
37.5
In the wild
Unconfirmed
What it is

OpenSTAManager is an open source management software for technical assistance and invoicing. In version 2.9.8 and prior, a SQL Injection vulnerability exists in the ajax_complete.php endpoint when handling the get_sedi operation. An authenticated attacker can inject malicious SQL code through the idanagrafica parameter, leading to unauthorized database access. At time of publication, no known patch exists.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00443 · 37.5th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-02-04T17:42Z
EPSS history
Timeline
  • 04 FEB 17:42Z
    OpenSTAManager has a SQL Injection in ajax_complete.php (get_sedi endpoint)
    cvelistv5