CVE-2025-7886

Name of the Vulnerable Software and Affected Versions pmTicket Project-Management-Software versions prior to 2ef379da2075f4761a2c9029cf91d073474e7486

Description A critical issue exists in pmTicket Project-Management-Software. The getUserLanguage function within the classes/class.database.php file is susceptible to SQL injection due to manipulation of the user id argument. This allows for remote exploitation. The vendor was contacted regarding this disclosure but did not respond.

Recommendations Versions prior to 2ef379da2075f4761a2c9029cf91d073474e7486: Restrict or disable the use of the getUserLanguage function until a suitable update is available.