Openstamanager — PoC Archivehttps://poc.intelseclab.com/tags/openstamanager/Latest proof-of-concept entries.Hugoen-usSun, 05 Jul 2026 00:00:00 +0000OpenSTAManager Scadenzario Bulk Operations Error-Based SQL Injection — CVE-2026-24418https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24418-openstamanager-sqli-scadenzario/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24418-openstamanager-sqli-scadenzario/High severity (CVSS 8.8) — web · CVE-2026-24418. Status: Weaponized. Affects: OpenSTAManager (devcode-it/openstamanager). Tags: sql-injection, error-based, openstamanager, php, extractvalue, rce, credential-theft, authenticated.webHighsql-injectionerror-basedopenstamanagerphpextractvaluercecredential-theftauthenticatedOpenSTAManager Reflected XSS via `righe` Parameter (CVE-2026-24415)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24415-openstamanager-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24415-openstamanager-xss/Medium severity — web · CVE-2026-24415 (GHSA-jfgp-g7x7-j25j). Status: PoC. Affects: OpenSTAManager (devcode-it/openstamanager). Tags: xss, reflected-xss, openstamanager, cwe-79, session-hijacking, php, unauthenticated-payload.webMediumxssreflected-xssopenstamanagercwe-79session-hijackingphpunauthenticated-payloadOpenSTAManager Prima Nota Error-Based SQL Injection — CVE-2026-24419https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24419-openstamanager-sqli-prima-nota/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24419-openstamanager-sqli-prima-nota/High severity — web · CVE-2026-24419. Status: PoC. Affects: OpenSTAManager (devcode-it/openstamanager). Tags: sql-injection, error-based, openstamanager, php, extractvalue, credential-theft, authenticated.webHighsql-injectionerror-basedopenstamanagerphpextractvaluecredential-theftauthenticatedOpenSTAManager Global Search Amplified Time-Based Blind SQL Injection — CVE-2026-24417https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24417-openstamanager-sqli-search-dos/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24417-openstamanager-sqli-search-dos/High severity — web · CVE-2026-24417. Status: PoC. Affects: OpenSTAManager (devcode-it/openstamanager). Tags: sql-injection, time-based-blind, openstamanager, php, denial-of-service, ajax, authenticated.webHighsql-injectiontime-based-blindopenstamanagerphpdenial-of-serviceajaxauthenticatedOpenSTAManager Article Pricing Time-Based Blind SQL Injection — CVE-2026-24416https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24416-openstamanager-sqli-article-pricing/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24416-openstamanager-sqli-article-pricing/High severity — web · CVE-2026-24416. Status: PoC. Affects: OpenSTAManager (devcode-it/openstamanager). Tags: sql-injection, time-based-blind, openstamanager, php, ajax, credential-theft, authenticated.webHighsql-injectiontime-based-blindopenstamanagerphpajaxcredential-theftauthenticated