PT-2025-39803 · Unknown · Pmticket Project-Management-Software

Allan Njuguna · Published 2025-09-29 · Updated 2025-10-04 · CVE-2025-11135

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions pmTicket Project-Management-Software versions prior to 2ef379da2075f4761a2c9029cf91d073474e7486

Description A flaw exists in pmTicket Project-Management-Software related to the deserialization of data. The issue is located in the loadLanguage function within the classes/class.database.php file, part of the Cookie Handler component. Manipulation of the user id argument can trigger this deserialization. The attack can be performed remotely. The exploit is publicly available. The software uses continuous delivery with rolling releases, and the vendor did not respond to early disclosure attempts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Deserialization of Untrusted Data

RCE

Weakness Enumeration

CWE-502

CWE-20

Related Identifiers

CVE-2025-11135

Affected Products

Pmticket Project-Management-Software

References · 9

• 🔥 https://asciinema.org/a/kTWHQMM7n6QH98gGCW3e7T9xT · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-11135 · Security Note
• https://twitter.com/cracbot/status/1974429331586683334 · Twitter Post
• https://vuldb.com/?id.326212 · Note
• https://t.me/CVEtracker/33606 · Telegram Post
• https://t.me/cveNotify/136764 · Telegram Post
• https://vuldb.com/?ctiid.326212 · Note
• https://vuldb.com/?submit.657302 · Note
• https://drive.google.com/file/d/18T4Gpzic0OQ-hzZWR6YoJ127QV3Jxyxe/view · Note