Vulnerability · Published Feb 6, 2026 · Assigned by GitHub_M
CVE-2025-69216OpenSTAManager has an SQL Injection in Scadenzario Print Template
High 8.7
In plain English
A high-severity SQL injection in openstamanager from devcode-it. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, an authenticated SQL injection vulnerability in OpenSTAManager's Scadenzario (Payment Schedule) print template allows any authenticated user to extract sensitive data from the database, including admin credentials, customer information, and financial records. The vulnerability exists in templates/scadenzario/init.php, where the id_anagrafica parameter is directly concatenated into an SQL query without proper sanitization. The vulnerability enables complete database read access through error-based SQL injection techniques.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | devcode-it/openstamanager | no fix listed | GHSA-q6g3-fv43-m2w6 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| devcode-it | openstamanager | <= 2.9.8 |
Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N