CVE-2025-69213: OpenSTAManager has a SQL Injection in ajax_complete.php (get_sedi endpoint)

February 3, 2026 (updated February 18, 2026)

A SQL Injection vulnerability exists in the ajax_complete.php endpoint when handling the get_sedi operation. An authenticated attacker can inject malicious SQL code through the idanagrafica parameter, leading to unauthorized database access.

References

github.com/advisories/GHSA-w995-ff8h-rppg
github.com/devcode-it/openstamanager
github.com/devcode-it/openstamanager/security/advisories/GHSA-w995-ff8h-rppg
nvd.nist.gov/vuln/detail/CVE-2025-69213

Code Behaviors & Features

Detect and mitigate CVE-2025-69213 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →