CVE-2026-114242
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
A vulnerability was identified in Insurance-Management-System in the `mysqli_query` function of `/Admin/View/editPlan.php`. Manipulation of the `Plan_no/Name` argument leads to SQL injection. The attack can be executed remotely, and the exploit is publicly available.
Risk Assessment
Remote SQL injection may allow unauthorized database access, modification, or data leakage.
Recommendation
Apply patches or mitigations (e.g., input validation) until an update is provided by the project.
Other vulnerabilities in Insurance-Management-System
See all- CVE-2026-114249High
A vulnerability was detected in Insurance-Management-System in unknown code of `/Agent/includes/UpdatePolicyHolder-inc.php` within the Policy Holder Update Form component. Manipulation of the `Policy_no` argument results in improper authorization. The attack can be launched remotely, and the exploit is now public.
- CVE-2026-114243High
A SQL injection vulnerability was found in the Insurance-Management-System within the mysqli_query function of /Agent/ManagePolicy/EditPolicyHolder.php. Manipulating the Policy_no/Name argument allows SQL injection. The flaw can be exploited remotely and a public exploit is available.
- CVE-2024-31064Medium
A Cross Site Scripting (XSS) vulnerability in Insurance Management System version 1.0.0 and earlier allows a remote attacker to execute arbitrary JavaScript code in the victim's browser via the "First Name" input field.
Original NVD description (English source)
A vulnerability was identified in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected is the function mysqli_query of the file /Admin/View/editPlan.php. Such manipulation of the argument Plan_no/Name leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS