CVE-2026-96751

A vulnerability has been found in pmTicket Project-Management-Software up to 078fa56a782490c5059a0814f84df27984f4d7e2. This affects the function setSync of the file /ajax/add_project.php. Such manipulation of the argument conn_settings leads to sql injection. The attack may be launched remotely. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-74
• CWE-89

• https://asciinema.org/a/1230576
• https://vuldb.com/cve/CVE-2026-96751
• https://vuldb.com/submit/904342
• https://vuldb.com/vuln/409005
• https://vuldb.com/vuln/409005/cti

Published

Sep 24, 2026

Last Modified

Sep 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-96746An out-of-bounds write in the connection-monitoring logic of…6.5
• CVE-2026-96747The client-side field level encryption support in the MongoD…5
• CVE-2026-96748PyMongo's connection string parsing decodes percent-encoded …6.5
• CVE-2026-96749An integer overflow in the BSON document encoding component …8.4
• CVE-2026-9675Impact: The undici WebSocket client enforces maxPayloadSize …7.5
• CVE-2026-96750MongoDB Compass can interpolate a database name without esca…7.1
• CVE-2026-96752The Zero Spam for WordPress plugin for WordPress is vulnerab…7.2
• CVE-2026-96754orval versions before 8.29.0 contain a code injection vulner…9.8
• CVE-2026-96755orval versions 8.14.0 through 8.28.1 contain a code injectio…9.8
• CVE-2026-96756orval versions before 8.30.0 contain a code injection vulner…8.1
• CVE-2026-96757orval before 8.29.0 fails to escape OpenAPI media-type keys …9.8
• CVE-2026-96758orval @orval/core before 8.28.0 contains a code injection vu…9.8