CVE-2025-11135

Name of the Vulnerable Software and Affected Versions pmTicket Project-Management-Software versions prior to 2ef379da2075f4761a2c9029cf91d073474e7486

Description A flaw exists in pmTicket Project-Management-Software related to the deserialization of data. The issue is located in the loadLanguage function within the classes/class.database.php file, part of the Cookie Handler component. Manipulation of the user id argument can trigger this deserialization. The attack can be performed remotely. The exploit is publicly available. The software uses continuous delivery with rolling releases, and the vendor did not respond to early disclosure attempts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.