CVE-2026-114243
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A SQL injection vulnerability was found in the Insurance-Management-System within the mysqli_query function of /Agent/ManagePolicy/EditPolicyHolder.php. Manipulating the Policy_no/Name argument allows SQL injection. The flaw can be exploited remotely and a public exploit is available.
Risk Assessment
An attacker could remotely execute arbitrary SQL queries, potentially leading to data leakage, modification, or deletion. Since the exploit is public, the risk of rapid exploitation is high.
Recommendation
Apply the fix or mitigation (e.g., input validation and parameterized queries) as soon as possible and restrict access to the application. Monitor logs for SQL injection attempts.
Other vulnerabilities in Insurance-Management-System
See all- CVE-2026-114249High
A vulnerability was detected in Insurance-Management-System in unknown code of `/Agent/includes/UpdatePolicyHolder-inc.php` within the Policy Holder Update Form component. Manipulation of the `Policy_no` argument results in improper authorization. The attack can be launched remotely, and the exploit is now public.
- CVE-2026-114242High
A vulnerability was identified in Insurance-Management-System in the `mysqli_query` function of `/Admin/View/editPlan.php`. Manipulation of the `Plan_no/Name` argument leads to SQL injection. The attack can be executed remotely, and the exploit is publicly available.
- CVE-2024-31064Medium
A Cross Site Scripting (XSS) vulnerability in Insurance Management System version 1.0.0 and earlier allows a remote attacker to execute arbitrary JavaScript code in the victim's browser via the "First Name" input field.
Original NVD description (English source)
A security flaw has been discovered in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected by this vulnerability is the function mysqli_query of the file /Agent/ManagePolicy/EditPolicyHolder.php. Performing a manipulation of the argument Policy_no/Name results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS