CVE-2026-35168 - Vulnerability Analysis

Overview

OpenSTAManager < 2.10.2 contains a SQL injection caused by unsanitized execution of JSON array of SQL statements in Aggiornamenti module, letting authenticated attackers execute arbitrary SQL commands.

Severity & Score

Impact

Authenticated attackers can execute arbitrary SQL commands, leading to full database compromise and data manipulation.

Mitigation

Update to version 2.10.2 or later.

References

• https://github.com/devcode-it/openstamanager/commit/43970676bcd6636ff8663652fd82579f737abb74
• https://github.com/devcode-it/openstamanager/releases/tag/v2.10.2
• https://github.com/devcode-it/openstamanager/security/advisories/GHSA-2fr7-cc4f-wh98

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Apr 4, 2026

🟠 CVE-2026-35168 - High (8.8) OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.10.2, the Aggiornamenti (Updates) module in OpenSTAManager contains a database conflict resolution feature (op=risolvi-conflitti-databa... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35168/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner