CVE-2025-69214: OpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint)

February 6, 2026 (updated February 10, 2026)

A SQL Injection vulnerability exists in the ajax_select.php endpoint when handling the componenti operation. An authenticated attacker can inject malicious SQL code through the options[matricola] parameter.

References

github.com/advisories/GHSA-qjv8-63xq-gq8m
github.com/devcode-it/openstamanager
github.com/devcode-it/openstamanager/security/advisories/GHSA-qjv8-63xq-gq8m
nvd.nist.gov/vuln/detail/CVE-2025-69214

Code Behaviors & Features

Detect and mitigate CVE-2025-69214 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →