What is the CVSS score of CVE-2025-69214?

CVE-2025-69214 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2025-69214?

OpenSTAManager versions 2.9.8 and earlier contain a critical SQL injection vulnerability that could allow attackers to access, modify, or delete sensitive business data including customer…

Is there a public PoC exploit available for CVE-2025-69214?

Yes, a public proof-of-concept exploit is available for CVE-2025-69214. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-69214?

Within 24 hours: Immediately audit access logs to the ajax_select.php endpoint and identify any suspicious activity; disable the componenti operation if possible without disrupting critical operations. Within 7 days: Deploy WAF rules to block malicious SQL injection patterns targeting ajax_select.php and implement network segmentation to restrict access to this application from untrusted networks. Within 30 days: Evaluate alternative management software or plan for immediate patching once vendor releases a security update; conduct a full database audit for unauthorized access or data exfiltration.

PHP CVE-2025-69214

HIGH

SQL Injection (CWE-89)

2026-02-06 security-advisories@github.com

GHSA-qjv8-63xq-gq8m

PHP SQLi Openstamanager Devcode

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 09, 2026 - 21:53 vuln.today

Public exploit code

CVE Published

Feb 06, 2026 - 19:16 nvd

HIGH 8.8

DescriptionGitHub Advisory

OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, an SQL Injection vulnerability exists in the ajax_select.php endpoint when handling the componenti operation. An authenticated attacker can inject malicious SQL code through the options[matricola] parameter.

AnalysisAI

Technical ContextAI

Classified as CWE-89 (SQL Injection). Affects the ajax_select.php component of Openstamanager. OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, an SQL Injection vulnerability exists in the ajax_select.php endpoint when handling the componenti operation. An authenticated attacker can inject malicious SQL code through the options[matricola] parameter.

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.