What is the CVSS score of EUVD-2026-18336?

EUVD-2026-18336 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Openstamanager are affected by EUVD-2026-18336?

OpenSTAManager versions prior to 2.10.2 contain a critical SQL injection vulnerability in the Updates module that allows authenticated users to execute arbitrary database commands, potentially…. A patch is available.

How to fix or mitigate EUVD-2026-18336?

Within 24 hours: Inventory all OpenSTAManager deployments and identify current versions; restrict access to the Aggiornamenti (Updates) feature to administrators only via role-based access controls and disable the feature if not actively required. Within 7 days: Upgrade to OpenSTAManager 2.10.2 or later immediately; test the patched version in a staging environment before production deployment. Within 30 days: Conduct database audit for unauthorized SQL activity in transaction logs; review access logs for suspicious Updates feature usage; implement database activity monitoring if not already in place.

Openstamanager EUVD-2026-18336

| CVE-2026-35168 HIGH

SQL Injection (CWE-89)

2026-04-02 security-advisories@github.com

GHSA-2fr7-cc4f-wh98

SQLi Openstamanager Devcode

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 03, 2026 - 08:30 nvd

Patch available

EUVD ID Assigned

Apr 02, 2026 - 14:22 euvd

EUVD-2026-18336

Analysis Generated

Apr 02, 2026 - 14:22 vuln.today

CVE Published

Apr 02, 2026 - 14:16 nvd

HIGH 8.8

DescriptionGitHub Advisory

OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.10.2, the Aggiornamenti (Updates) module in OpenSTAManager contains a database conflict resolution feature (op=risolvi-conflitti-database) that accepts a JSON array of SQL statements via POST and executes them directly against the database without any validation, allowlist, or sanitization. An authenticated attacker with access to the Aggiornamenti module can execute arbitrary SQL statements including CREATE, DROP, ALTER, INSERT, UPDATE, DELETE, SELECT INTO OUTFILE, and any other SQL command supported by the MySQL server. Foreign key checks are explicitly disabled before execution (SET FOREIGN_KEY_CHECKS=0), further reducing database integrity protections. This issue has been patched in version 2.10.2.

AnalysisAI

Arbitrary SQL execution in OpenSTAManager's database conflict resolution module allows authenticated attackers with access to the Aggiornamenti (Updates) feature to execute unrestricted SQL commands. Affecting versions prior to 2.10.2, attackers can submit JSON arrays of SQL statements that execute directly against the MySQL database with foreign key checks disabled, enabling complete database compromise including data exfiltration, modification, deletion, and schema manipulation. No public exploit identified at time of analysis, though EPSS data not available; authentication requirement (PR:L) and low attack complexity (AC:L) indicate straightforward exploitation for internal threats or compromised accounts.

Technical ContextAI

This vulnerability affects OpenSTAManager, an Italian open-source ERP system for technical assistance and invoicing management. The flaw resides in the database update/conflict resolution feature (op=risolvi-conflitti-database endpoint) which processes JSON-encoded SQL statement arrays submitted via POST requests. The implementation fails to implement any form of SQL statement validation, parameterized queries, or allowlisting of permitted database operations. The code explicitly disables MySQL foreign key constraint checking (SET FOREIGN_KEY_CHECKS=0) before executing submitted statements, removing a critical data integrity protection layer. This represents a classic CWE-89 SQL Injection vulnerability, but with an unusually dangerous twist: rather than exploiting improper input sanitization in a legitimate query, the application intentionally accepts raw SQL as functional input without access controls on command types. The vulnerability allows execution of Data Definition Language (DDL) operations like CREATE/DROP/ALTER alongside Data Manipulation Language (DML) commands, and even MySQL-specific extensions like SELECT INTO OUTFILE for filesystem writes.

RemediationAI

Upgrade immediately to OpenSTAManager version 2.10.2 or later, which contains the complete fix for this arbitrary SQL execution vulnerability as documented in the official release at github.com/devcode-it/openstamanager/releases/tag/v2.10.2. The patch implementation can be reviewed in commit 43970676bcd6636ff8663652fd82579f737abb74 on the project's GitHub repository. As a temporary risk reduction measure for environments unable to upgrade immediately, restrict access to the Aggiornamenti module to only essential administrative accounts through application-level permission controls, implement network segmentation to limit access to the administrative interface, and monitor database query logs for suspicious DDL/DML operations or foreign key check disablement commands. However, these workarounds provide only partial protection and should not be considered long-term solutions. Full remediation details are available in the GitHub Security Advisory at github.com/devcode-it/openstamanager/security/advisories/GHSA-2fr7-cc4f-wh98.