OpenSTAManager v2.9.8 and earlier allow a critical error‑based SQL injection through the bulk operations handler in the Scadenzario module. The code does not enforce integer validation on elements of the id_records array before inserting them into an SQL IN() clause, permitting an attacker to inject arbitrary SQL commands. This can lead to extraction of sensitive data via XPATH error messages and potentially further compromise of the database. The weakness maps to CWE-89, a classic injection flaw.

The vulnerability exists in devcode-it OpenSTAManager versions 2.9.8 and earlier. Users running these versions on any platform that exposes the Scadenzario bulk operations interface are affected.

The CVSS score of 8.7 indicates a high severity, while the EPSS score of less than 1% suggests a low current exploitation probability. The advisory is not listed in the CISA KEV catalog, implying no confirmed widespread exploitation at the time of assessment. Exploitation likely requires access to the bulk operations API or web interface; it is inferred that authenticated or privileged users could use the vulnerable parameter to inject malicious SQL. The lack of immediate public exploitation mitigates urgency, but the high impact and available attack vector warrant prompt action.