CVE-2025-65103

HighCVSS 8.8/10Last modified Oct 18, 2026

Description

OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.9.5, an authenticated SQL Injection vulnerability in the API allows any user, regardless of permission level, to execute arbitrary SQL queries. By manipulating the display parameter in an API request, an attacker can exfiltrate, modify, or delete any data in the database, leading to a full system compromise. This issue has been patched in version 2.9.5.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Nov 19, 2025
Last modified: Oct 18, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-651047.5Firebird is an open-source relational database management system. In versions FB3 of the client library placed incorrect data length values CVE-2025-651055.3Apptainer is an open source container platform. In Apptainer versions less than 1.4.5, a container can disable two of the forms of the littl CVE-2025-651068.3LangChain is a framework for building agents and LLM-powered applications. From versions 0.3.79 and prior and 1.0.0 to 1.0.6, a template inj CVE-2025-651076.5Langfuse is an open source large language model engineering platform. In versions from 2.95.0 to before 2.95.12 and from 3.17.0 to before 3.CVE-2025-6510810.0md-to-pdf is a CLI tool for converting Markdown files to PDF using Node.js and headless Chrome. Prior to version 5.2.5, a Markdown front-mat CVE-2025-651098.5Minder is an open source software supply chain security platform. In Minder Helm version 0.20241106.3386+ref.2507dbf and Minder Go versions CVE-2025-65118.8A vulnerability classified as critical has been found in Netgear EX6150 1.0.0.46_1.0.76. This affects the function sub_410090. The manipulat CVE-2025-651109.3Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Prior to versions CVE-2025-651115.3SpiceDB is an open source database system for creating and managing security-critical application permissions. Prior to version 1.47.1, if a CVE-2025-651129.8PubNet is a self-hosted Dart & Flutter package service. Prior to version 1.1.3, the /api/storage/upload endpoint in PubNet allows unauthenti CVE-2025-651136.5ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.2 - #164, an authorization bypass vulnerability in the AJAX fla CVE-2025-651147.5Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 9.0.0 thr