{"items":[{"id":"NVI-00003849","kind":"vulnerability","title":"OpenSTAManager Affected by XSS in modifica_iva.php via righe parameter","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-jfgp-g7x7-j25j","CVE-2026-24415"],"plain_summary":"OSV carries this publisher advisory for devcode-it/openstamanager. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 2.9.8 for devcode-it/openstamanager. Confirm the publisher’s latest guidance.","source_ids":["sr-4d347bda691639e6896e1a5f5bfea4e8"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-9a9b6ff6f50d5108d99cdc911fa0301f"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-06-17T10:23:02.147Z","value":"6.1 MEDIUM (3.1)","meaning":"nvd@nist.gov severity; no combined Null risk score.","source_id":"sr-9a9b6ff6f50d5108d99cdc911fa0301f"},{"kind":"CVSS","as_of":"2026-06-17T10:23:02.147Z","value":"5.1 MEDIUM (4.0)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-9a9b6ff6f50d5108d99cdc911fa0301f"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-4d347bda691639e6896e1a5f5bfea4e8","url":"https://github.com/advisories/GHSA-jfgp-g7x7-j25j","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-jfgp-g7x7-j25j","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:20.441Z"},{"id":"sr-9a9b6ff6f50d5108d99cdc911fa0301f","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24415","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-24415","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-01T01:40:47.597Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-4d347bda691639e6896e1a5f5bfea4e8"],"technology":"devcode-it/openstamanager","known_exclusions":[],"conditions_summary":"### Summary\n\nMultiple Reflected Cross-Site Scripting (XSS) vulnerabilities in OpenSTAManager v2.9.8 allow unauthenticated attackers to execute arbitrary JavaScript code in the context of other users' browsers through crafted URL parameters, potentially leading to session hijacking, credential theft, and unauthorized actions.\n\n**Vulnerable Parameter:** `righe` (GET)\n\n### Details\n\nOpenSTAManager v2.9.8 contains multiple Reflected XSS vulnerabilities in invoice/order/contract modification modals. The application fails to properly sanitize user-supplied input from the `righe` GET parameter before reflecting it in HTML output.\n\n**Vulnerable Code Location:**\nFile: `/modules/contratti/modals/modifica_iva.php` (Line 125)\n\n```php\n\">\n```\n\nThe `$_GET['righe']` parameter is directly echoed into the HTML `value` attribute without any sanitization using `htmlspecialchars()` or equivalent functions. This allows an attacker to break out of the attribute context and inject arbitrary HTML/JavaScript.\n\n**All Affected Files:**\n\n1. `/modules/contratti/modals/modifica_iva.php` - **Line 125, Line 167**\n2. `/modules/preventivi/modals/mo","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 2.9.8"]}],"null_published_at":"2026-11-06T15:18:11.507Z","source_updated_at":"2026-03-04T15:26:22.987Z","source_disclosed_at":"2026-03-03T17:39:00.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T21:42:20.441Z"},{"id":"NVI-00003849","kind":"vulnerability","title":"OpenSTAManager Affected by XSS in modifica_iva.php via righe parameter","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-jfgp-g7x7-j25j","CVE-2026-24415"],"plain_summary":"OSV carries this publisher advisory for devcode-it/openstamanager. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 2.9.8 for devcode-it/openstamanager. Confirm the publisher’s latest guidance.","source_ids":["sr-4d347bda691639e6896e1a5f5bfea4e8"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-4d347bda691639e6896e1a5f5bfea4e8","url":"https://github.com/advisories/GHSA-jfgp-g7x7-j25j","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-jfgp-g7x7-j25j","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:20.441Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-4d347bda691639e6896e1a5f5bfea4e8"],"technology":"devcode-it/openstamanager","known_exclusions":[],"conditions_summary":"### Summary\n\nMultiple Reflected Cross-Site Scripting (XSS) vulnerabilities in OpenSTAManager v2.9.8 allow unauthenticated attackers to execute arbitrary JavaScript code in the context of other users' browsers through crafted URL parameters, potentially leading to session hijacking, credential theft, and unauthorized actions.\n\n**Vulnerable Parameter:** `righe` (GET)\n\n### Details\n\nOpenSTAManager v2.9.8 contains multiple Reflected XSS vulnerabilities in invoice/order/contract modification modals. The application fails to properly sanitize user-supplied input from the `righe` GET parameter before reflecting it in HTML output.\n\n**Vulnerable Code Location:**\nFile: `/modules/contratti/modals/modifica_iva.php` (Line 125)\n\n```php\n\">\n```\n\nThe `$_GET['righe']` parameter is directly echoed into the HTML `value` attribute without any sanitization using `htmlspecialchars()` or equivalent functions. This allows an attacker to break out of the attribute context and inject arbitrary HTML/JavaScript.\n\n**All Affected Files:**\n\n1. `/modules/contratti/modals/modifica_iva.php` - **Line 125, Line 167**\n2. `/modules/preventivi/modals/mo","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 2.9.8"]}],"null_published_at":"2026-10-31T22:12:52.599Z","source_updated_at":"2026-03-04T15:26:22.987Z","source_disclosed_at":"2026-03-03T17:39:00.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:42:20.441Z"}],"next_cursor":null,"snapshot_revision":"42594"}