HIGH
Devcode
CVE published 2026-04-02
CVE-2026-28805
OpenSTAManager, an open-source management software for technical assistance and invoicing, is vulnerable to Time-Based Blind SQL Injection through multiple AJAX select handlers. An authenticated attacker can inject arbitrary SQL statements to extract sensitive data from the database, including usernames, password hashes, financial records, and other information stored in the MySQL database. This vulnerabi [truncated]