OpenSTAManager v2.9.8 and earlier include a reflected XSS flaw in the invoice/order/contract modification modals. The application echoes the user‑supplied 'righe' GET parameter directly into an HTML value attribute without escaping. This permits an attacker to inject arbitrary HTML or JavaScript, allowing malicious code execution within the victim’s browser session and potentially leading to cookie theft, phishing, or other client‑side attacks. The weakness is a classic CWE‑79 reflected XSS issue. Based on the description, it is inferred that the attacker must craft a malicious link containing a dangerous 'righe' value to exploit the vulnerability and trick a victim into visiting the page. The impact is confined to the context of the page where the malformed value is reflected; it does not provide escalation of privileges on the server but can compromise confidentiality and integrity of user interactions.

The vulnerability affects the open source OpenSTAManager product by devcode‑it. Versions up to and including 2.9.8 are vulnerable. Any deployment of these releases that exposes the invoice/order/contract modification interfaces to unauthenticated or authenticated users may be impacted.

The CVSS score is 5.1, classifying it as a medium severity vulnerability, and the EPSS score is below 1%, indicating a low predicted exploitation likelihood. The flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker would need to craft a malicious URL that includes a dangerous 'righe' parameter to trigger the vulnerability, then entice a victim to load the page. The attack requires only user interaction with the malicious link and does not need special software or privileged access.