CVE-2026-24415 OpenSTAManager affected by reflected XSS in modifica_iva.php via righe parameter
Attackers can inject arbitrary JavaScript via the righe parameter in OpenSTAManager, potentially leading to session hijacking or malicious actions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-24415?
CVE-2026-24415 is a medium-severity cross-site scripting vulnerability in devcode-it openstamanager, published on 3 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contains Reflected XSS vulnerabilities in invoice/order/contract modification modals. The application fails to properly sanitize user-supplied input from the righe GET parameter before reflecting it in HTML output.The $_GET['righe'] parameter is directly echoed into the HTML value attribute without any sanitization using htmlspecialchars() or equivalent functions. This allows an attacker to break out of the attribute context and inject arbitrary HTML/JavaScript.
Weakness: CWE-79
Which versions are affected by CVE-2026-24415?
2 open source packages ship an affected version, including devcode-it/openstamanager. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
devcode-it/openstamanager Packagist | All versions | 2.9.8 |
devcode-it/openstamanager Packagist | All versions | 2.9.8 |
Products include Devcode Openstamanager.
How do I fix CVE-2026-24415?
Upgrade devcode-it/openstamanager to 2.9.8 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-24415 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-24415 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in devcode-it openstamanager
- CVE-2026-27012 Unauthenticated privilege escalation in OpenSTAManager via modules/utenti/actions.php
- CVE-2025-69212 OpenSTAManager has an OS Command Injection in P7M File Processing
- CVE-2026-35470 OpenSTAManager has a SQL Injection via righe Parameter in confronta_righe Modals
- CVE-2026-28805 OpenSTAManager: Time-Based Blind SQL Injection via `options[stato]` Parameter
- CVE-2026-35168 OpenSTAManager: SQL Injection via Aggiornamenti Module
Sources
Also known as GHSA-jfgp-g7x7-j25j.