CVE-2026-38751

OpenSTAManager version 2.10 and earlier contains an arbitrary file upload vulnerability in the module update functionality (modules/aggiornamenti/upload_modules.php)

CVSS v3.1 CNA

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0.53% chance of exploitation in the next 30 days, 44th percentile

Published

2026-05-04

Updated

2026-05-05

Proof-of-concept exploits (5)

• fuutianyii/poc
• b0ySie7e/OpenSTAManager-RCE-Exploit-CVE-2026-387519★ · 2026-06-30
• Why-Shell/CVE-2026-387510★ · 2026-06-28
• hackthem/OpenSTAManager_RCE_Exploit-CVE-2026-38751-1★ · 2026-07-01
• Mkps/CVE-2026-38751-OpenSTAManager-Arbitrary-File-Upload-PoC0★ · 2026-07-04

Security advisories

• advisories/GHSA-rm34-fg4m-39mw
• devcode-it/openstamanager

References

• CVE Record
• NVD entry

Related

• CVE-2025-24893
• CVE-2025-3248
• CVE-2025-49144