CVE-2026-24415
published 2026-03-03CVE-2026-24415: OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contains Reflected XSS…
PriorityP426medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.24%
15.6th percentile
OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contains Reflected XSS vulnerabilities in invoice/order/contract modification modals. The application fails to properly sanitize user-supplied input from the righe GET parameter before reflecting it in HTML output.The $_GET['righe'] parameter is directly echoed into the HTML value attribute without any sanitization using htmlspecialchars() or equivalent functions. This allows an attacker to break out of the attribute context and inject arbitrary HTML/JavaScript.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| devcode-it | openstamanager | <= 2.9.8 | — |
| devcode-it | openstamanager | >= 0 < 2.9.8 | 2.9.8 |
| devcode | openstamanager | <= 2.9.8 | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv4.05.1MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
OpenSTAManager Affected by XSS in modifica_iva.php via righe parameter
ghsa·2026-03-03
CVE-2026-24415 [MEDIUM] CWE-79 OpenSTAManager Affected by XSS in modifica_iva.php via righe parameter
OpenSTAManager Affected by XSS in modifica_iva.php via righe parameter
### Summary
Multiple Reflected Cross-Site Scripting (XSS) vulnerabilities in OpenSTAManager v2.9.8 allow unauthenticated attackers to execute arbitrary JavaScript code in the context of other users' browsers through crafted URL parameters, potentially leading to session hijacking, credential theft, and unauthorized actions.
**Vulnerable Parameter:** `righe` (GET)
### Details
OpenSTAManager v2.9.8 contains multiple Reflected XSS vulnerabilities in invoice/order/contract modification modals. The application fails to properly sanitize user-supplied input from the `righe` GET parameter before reflecting it in HTML output.
**Vulnerable Code Location:**
File: `/modules/contratti/modals/modifica_iva.php` (Line 125)
```p
OSV
OpenSTAManager Affected by XSS in modifica_iva.php via righe parameter
osv·2026-03-03
CVE-2026-24415 [MEDIUM] OpenSTAManager Affected by XSS in modifica_iva.php via righe parameter
OpenSTAManager Affected by XSS in modifica_iva.php via righe parameter
### Summary
Multiple Reflected Cross-Site Scripting (XSS) vulnerabilities in OpenSTAManager v2.9.8 allow unauthenticated attackers to execute arbitrary JavaScript code in the context of other users' browsers through crafted URL parameters, potentially leading to session hijacking, credential theft, and unauthorized actions.
**Vulnerable Parameter:** `righe` (GET)
### Details
OpenSTAManager v2.9.8 contains multiple Reflected XSS vulnerabilities in invoice/order/contract modification modals. The application fails to properly sanitize user-supplied input from the `righe` GET parameter before reflecting it in HTML output.
**Vulnerable Code Location:**
File: `/modules/contratti/modals/modifica_iva.php` (Line 125)
```p
No detection rules found.
No public exploits indexed.
2026-03-03
Published