CVE-2026-114249
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
A vulnerability was detected in Insurance-Management-System in unknown code of `/Agent/includes/UpdatePolicyHolder-inc.php` within the Policy Holder Update Form component. Manipulation of the `Policy_no` argument results in improper authorization. The attack can be launched remotely, and the exploit is now public.
Risk Assessment
Remote authorization bypass may allow unauthorized modifications of policyholder data.
Recommendation
Apply patches or mitigations (e.g., permission checks) until an update is provided by the project.
Other vulnerabilities in Insurance-Management-System
See all- CVE-2026-114243High
A SQL injection vulnerability was found in the Insurance-Management-System within the mysqli_query function of /Agent/ManagePolicy/EditPolicyHolder.php. Manipulating the Policy_no/Name argument allows SQL injection. The flaw can be exploited remotely and a public exploit is available.
- CVE-2026-114242High
A vulnerability was identified in Insurance-Management-System in the `mysqli_query` function of `/Admin/View/editPlan.php`. Manipulation of the `Plan_no/Name` argument leads to SQL injection. The attack can be executed remotely, and the exploit is publicly available.
- CVE-2024-31064Medium
A Cross Site Scripting (XSS) vulnerability in Insurance Management System version 1.0.0 and earlier allows a remote attacker to execute arbitrary JavaScript code in the victim's browser via the "First Name" input field.
Original NVD description (English source)
A vulnerability was detected in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. This vulnerability affects unknown code of the file /Agent/includes/UpdatePolicyHolder-inc.php of the component Policy Holder Update Form. The manipulation of the argument Policy_no results in improper authorization. It is possible to launch the attack remotely. The exploit is now public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS