PT-2025-30188 · Unknown · Pmticket Project-Management-Software

Allan Njuguna · Published 2025-07-20 · Updated 2025-07-20 · CVE-2025-7886

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions pmTicket Project-Management-Software versions prior to 2ef379da2075f4761a2c9029cf91d073474e7486

Description A critical issue exists in pmTicket Project-Management-Software. The getUserLanguage function within the classes/class.database.php file is susceptible to SQL injection due to manipulation of the user id argument. This allows for remote exploitation. The vendor was contacted regarding this disclosure but did not respond.

Recommendations Versions prior to 2ef379da2075f4761a2c9029cf91d073474e7486: Restrict or disable the use of the getUserLanguage function until a suitable update is available.

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2025-7886

Affected Products

Pmticket Project-Management-Software

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-7886 · Security Note
• https://t.me/cvenotify/129599 · Telegram Post
• https://vuldb.com/?ctiid.317001 · Note
• https://twitter.com/CVEnew/status/1946900513301082485 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1946918320285925523 · Twitter Post
• https://vuldb.com/?submit.614534 · Note
• https://t.me/cvetracker/28262 · Telegram Post
• https://vuldb.com/?id.317001 · Note
• https://asciinema.org/a/3wu3WGpnrnMc2GDvSyLUqqHUF · Note
• https://twitter.com/marcin_brz81183/status/1946928588630138996 · Twitter Post