SQL Injection Vulnerability in pmTicket Project-Management-Software
CVE-2026-96751

6.9MEDIUM

Key Information:

Vendor

Pmticket

Status
Project-management-software
Vendor
CVE Published:
23 September 2026

What is CVE-2026-96751?

The pmTicket Project-Management-Software is vulnerable to SQL injection due to improper handling of user input in the setSync function located in /ajax/add_project.php. This vulnerability can be exploited by an attacker to manipulate the conn_settings argument, allowing unauthorized access to the database. The vulnerability may be remotely executed, posing a significant security risk. The product operates on a rolling release model, therefore specific version details are not provided. Attempts to communicate this issue to the vendor have gone unanswered.

Affected Version(s)

Project-Management-Software 078fa56a782490c5059a0814f84df27984f4d7e2

References

https://vuldb.com/vuln/409005
vdb-entrytechnical-description
https://vuldb.com/vuln/409005/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-96751
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Allan Njuguna (VulDB User)
VulDB CNA Team
.