CVE-2026-3057 | a54552239 pearProjectApi up to 2.8.10 Backend Interface Task.php dateTotalForProject projectCode sql injection

A vulnerability, which was classified as critical, was found in a54552239 pearProjectApi up to 2.8.10. Affected is the function dateTotalForProject of the file application/common/Model/Task.php of the component Backend Interface. The manipulation of the argument projectCode results in sql injection.

This vulnerability is reported as CVE-2026-3057. The attack can be launched remotely. Moreover, an exploit is present.

The vendor was contacted early about this disclosure but did not respond in any way.