EUVD-2025-18438Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to application
-
DeliverySend crafted POST request to /insertPayment.php with malicious recipt_no
-
ExploitSQL injection in backend query
-
ExecutionExtract data from database
-
ImpactImpact on confidentiality
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | The attacker must have low-privileged access to the application (PR:L from CVSS vector). The attack is network-based and requires no user interaction. The vulnerable parameter is |
| Impact | CVSS 4.0 vector indicates a low base score of 2.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N), reflecting low impact on confidentiality, integrity, and availability. However, the attack requires low privileges (PR:L) and is network-exploitable with low complexity. EPSS score is 0.06% (18th percentile), indicating low exploitation probability. A public exploit exists, but no active exploitation is confirmed (not in CISA KEV). The risk is moderate: while the CVSS score is low, the presence of a public exploit and the potential for data extraction elevate the practical risk for affected deployments. |
| Exploit ScenarioDerived | An attacker with low-privileged access to the Life Insurance Management System sends a crafted HTTP request to |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 26, 2026
SQL injection in Projectworlds Life Insurance Management System 1.0 allows remote authenticated attackers to manipulate the recipt_no parameter in /insertPayment.php, potentially leading to data breach or system compromise. A public exploit is available, but no active exploitation has been reported (not in CISA KEV). EPSS score is low (0.06%), suggesting limited exploitation likelihood.
Earlier versions of this analysis (1)
RemediationAI
No vendor-released patch identified at time of analysis. As a workaround, implement input validation and parameterized queries for the recipt_no parameter in /insertPayment.php. Additionally, restrict network access to the application to trusted users only. Note that these mitigations may require code changes and could affect functionality.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a SQL injection (CWE-74) in a PHP-based web application. The affected product is Projectworlds Life Insurance Management System version 1.0, as identified by CPE cpe:2.3:a:projectworlds:life_insurance_management_system:1.0:*:*:*:*:*:*:*. SQL injection occurs when user input is improperly sanitized before inclusion in SQL queries, allowing attackers to inject arbitrary SQL commands. The attack targets the recipt_no parameter in the /insertPayment.php script.
Know when Life Insurance Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
PR:L due to required authentication; impact limited to low C/I.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was found in Projectworlds Life Insurance Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /insertPayment.php. The manipulation of the argument recipt_no leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Executive ViewAI
Organizations using A vulnerability should be aware of moderate risk from CVE-2025-6136, a injection vulnerability rated CVSS 6.3. Exploitation could allow attackers to execute code or inject malicious input. Proof-of-concept code is publicly available. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: deploy WAF rules, restrict network access, enable logging.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
A vulnerability classified as critical was found in SourceCodester Life Insurance Management System 1.0. Rated critical
Aegon Life v1.0 was discovered to contain a SQL injection vulnerability via the client_id parameter at clientStatus.php.
A vulnerability was found in projectworlds Life Insurance Management System 1.0 and classified as critical.php. Rated me
A vulnerability, which was classified as critical, was found in projectworlds Life Insurance Management System 1.0. Rate
A vulnerability, which was classified as critical, has been found in projectworlds Life Insurance Management System 1.0.
A vulnerability classified as critical was found in projectworlds Life Insurance Management System 1.0. Rated medium sev
A vulnerability has been found in projectworlds Life Insurance Management System 1.0 and classified as critical. Rated m
A vulnerability classified as critical has been found in projectworlds Life Insurance Management System 1.0. Rated mediu
A cross-site scripting (XSS) vulnerability in Aegon Life v1.0 allows attackers to execute arbitrary web scripts or HTML
A vulnerability was found in SourceCodester Life Insurance Management System 1.0. Rated medium severity (CVSS 6.1), this
A vulnerability was found in Project Worlds Life Insurance Management System 1.0. Rated medium severity (CVSS 5.3), this
A vulnerability was found in Project Worlds Life Insurance Management System 1.0. Rated medium severity (CVSS 5.3), this
Exploit-DB