Description
A vulnerability was identified in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected is the function mysqli_query of the file /Admin/View/editPlan.php. Such manipulation of the argument Plan_no/Name leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-10-21
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote SQL Injection
Action: Update Software
AI Analysis

Impact

An SQL injection vulnerability exists in the Insurance-Management-System’s editPlan.php module, specifically within the mysqli_query function handling the Plan_no and Name parameters. An attacker can manipulate these inputs to alter the SQL query executed against the database, potentially allowing arbitrary database commands, data exfiltration, or tampering with policy records. The flaw is identified as CWE-74 and CWE-89.

Affected Systems

The vulnerability affects the dhikshitha29 Insurance-Management-System product, version information is not available due to a rolling release model. All deployed instances that include the admin/view/editPlan.php component are potentially impacted, regardless of the specific commit hash accessed through the repository.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity, and no EPSS data are available. The vulnerability is not listed in the CISA KEV catalog, but public exploits have been reported. The attack vector is remote, requiring only web accessibility to the editPlan.php endpoint. Successful exploitation could give the attacker read/write access to the underlying database, compromising confidentiality, integrity, and possibly availability of the application.

Generated by OpenCVE AI on October 21, 2026 at 19:17 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the Insurance‑Management‑System to the latest release or apply the vendor’s patch when it becomes available.
  • Implement strict authentication and role‑based access control to the editPlan.php endpoint, ensuring only authorized administrators can submit Plan_no and Name values.
  • Validate and sanitize all user input for Plan_no and Name, using parameterized queries or prepared statements before invoking mysqli_query.

Generated by OpenCVE AI on October 21, 2026 at 19:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 12:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected is the function mysqli_query of the file /Admin/View/editPlan.php. Such manipulation of the argument Plan_no/Name leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Title dhikshitha29 Insurance-Management-System editPlan.php mysqli_query sql injection
First Time appeared Dhikshitha29
Dhikshitha29 insurance-management-system
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:dhikshitha29:insurance-management-system:*:*:*:*:*:*:*:*
Vendors & Products Dhikshitha29
Dhikshitha29 insurance-management-system
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Dhikshitha29 Insurance-management-system
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-27T22:08:29.102Z

Reserved: 2026-10-21T06:50:17.798Z

Link: CVE-2026-114242

cve-icon Vulnrichment

Updated: 2026-10-27T22:08:22.673Z

cve-icon NVD

Status : Deferred

Published: 2026-10-21T12:17:19.560

Modified: 2026-10-27T23:16:57.677

Link: CVE-2026-114242

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T21:30:14Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')