CVE-2026-35470

OVERVIEW CVE-2026-35470 is a SQL injection vulnerability affecting OpenSTAManager, an open source technical assistance and invoicing management platform. The flaw resides in the confronta_righe.php files across multiple modules, where the "righe" GET parameter is directly concatenated into SQL queries without sanitization, parameterization, or validation. Versions prior to 2.10.2 are vulnerable. SEVERITY The vulnerability carries a CVSS score of 8.8 (High) with a network-accessible attack vector, low complexity, and low privilege requirements for exploitation. An authenticated attacker can inject arbitrary SQL statements to extract sensitive database information including user credentials, customer records, and invoice data. The vulnerability affects confidentiality, integrity, and availability of the system. EXPLOITATION STATUS There is no indication of active exploitation in the wild. The EPSS score of 0.00013 indicates this vulnerability is not currently prioritized relative to other CVEs in the broader threat landscape. No exploit code has been publicly disclosed, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog. Community attention appears minimal. Organizations running OpenSTAManager should prioritize patching to version 2.10.2 or later as a standard maintenance activity rather than an emergency response.