Vulnerability · Published Mar 3, 2026 · Assigned by GitHub_M
CVE-2026-24415OpenSTAManager affected by reflected XSS in modifica_iva.php via righe parameter
Medium 5.1
In plain English
A medium-severity cross-site scripting in openstamanager from devcode-it. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contains Reflected XSS vulnerabilities in invoice/order/contract modification modals. The application fails to properly sanitize user-supplied input from the righe GET parameter before reflecting it in HTML output.The $_GET['righe'] parameter is directly echoed into the HTML value attribute without any sanitization using htmlspecialchars() or equivalent functions. This allows an attacker to break out of the attribute context and inject arbitrary HTML/JavaScript.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | devcode-it/openstamanager | 2.9.8 | GHSA-jfgp-g7x7-j25j |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| devcode-it | openstamanager | <= 2.9.8 |
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N