CVE-2026-96751 describes a SQL injection vulnerability in the pmTicket Project-Management-Software up to commit 078fa56a782490c5059a0814f84df27984f4d7e2. The issue is located in the setSync function within the /ajax/add_project.php file, where manipulation of the conn_settings parameter enables SQL injection. The vulnerability can be exploited remotely without authentication. The product follows a rolling release development model, so no discrete affected or fixed version numbers are available. The vendor was contacted but did not provide any response or patch information.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to perform SQL injection attacks, potentially leading to unauthorized data access, data modification, or denial of service. The CVSS score of 7.3 reflects a medium severity with low attack complexity and no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch links are available, users should monitor official channels for updates. Until a fix is released, consider restricting access to the vulnerable endpoint or implementing web application firewall rules to detect and block SQL injection attempts targeting the conn_settings parameter in /ajax/add_project.php.