Deserialization in Pmticket Project-Management-Software
CVE-2025-11135
A vulnerability was detected in pmTicket Project-Management-Software up to 2ef379da2075f4761a2c9029cf91d073474e7486. The affected element is the function loadLanguage of the file classes/class.database.php of the component Cookie Handler. Performing manipulation of the argument user_id results in deserialization. The attack can be initiated remotely. The exploit is now public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.
EPSS exploit prediction
EPSS: 0.004 (33.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 34th percentile — 33.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- Pmticket Project-Management-Software — versions 2ef379da2075f4761a2c9029cf91d073474e7486
Weakness classification (CWE)
References
- vuldb.com/ (technical-description, vdb-entry)
- vuldb.com/ (signature, permissions-required)
- vuldb.com/ (third-party-advisory)
- drive.google.com/file/d/18T4Gpzic0OQ-hzZWR6YoJ127QV3Jxyxe/view (related)
- asciinema.org/a/kTWHQMM7n6QH98gGCW3e7T9xT (exploit)
Frequently asked questions
- What is CVE-2025-11135?
- CVE-2025-11135 is a high-severity vulnerability in Pmticket Project-Management-Software, classified under Improper Input Validation. CVSS score: 7.3/10. Published 2025-09-29.
- How severe is CVE-2025-11135?
- High severity. CVSS v3 base score is 7.3 out of 10.