CVE-2026-96751 - pmTicket Project-Management-Software add_project.php setSync sql injection

Back Back to CVE browser

MEDIUM

pmTicket Project-Management-Software add_project.php setSync sql injection

Published Sep 23, 2026

6.9

MEDIUM

CVSS 4.0

EPSS 0.25%

Description

A vulnerability has been found in pmTicket Project-Management-Software up to 078fa56a782490c5059a0814f84df27984f4d7e2. This affects the function setSync of the file /ajax/add_project.php. Such manipulation of the argument conn_settings leads to sql injection. The attack may be launched remotely. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

Vendor pmTicket Product Project-Management-Software Default
n/a
- Version
  
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

pmTicket

Project-Management-Software

n/a

Version	Status	Constraints
	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-74

CWE-89

SQL Injection

References (6)

https://asciinema.org/a/1230576
broken-link
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-85749
Advisory
https://vuldb.com/cve/CVE-2026-96751
third-party-advisory
https://vuldb.com/submit/904342
third-party-advisory
https://vuldb.com/vuln/409005
vdb-entrytechnical-description
https://vuldb.com/vuln/409005/cti
signaturepermissions-required

Link	Providers	Tags
https://asciinema.org/a/1230576		broken-link
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-85749		Advisory
https://vuldb.com/cve/CVE-2026-96751		third-party-advisory
https://vuldb.com/submit/904342		third-party-advisory
https://vuldb.com/vuln/409005		vdb-entrytechnical-description
https://vuldb.com/vuln/409005/cti		signaturepermissions-required