Insurance Management System CVE-2026-114242

Exploitation requires reaching the /Admin/View/editPlan.php endpoint and supplying a malicious Plan_no or Name parameter that flows into the mysqli_query call; the input CVSS vector asserts no authentication or user interaction (PR:N/UI:N). The primary LIMITING factor is deployment: this is a niche single-developer PHP application with essentially no production footprint, so reachable instances are scarce. A secondary caveat is that the endpoint resides under an /Admin/ path - if a deployment enforces admin authentication (the vector assumes it does not), exploitation would require valid admin access first. No patched version exists (rolling release, unacknowledged report), so no fixed configuration can currently mitigate it at the source level.

This is a classic low-to-moderate priority SQL injection (CWE-89) that scores higher on paper than it warrants in practice. The CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L) indicates a remotely reachable, low-complexity flaw with no authentication or user interaction, and the E:P (Proof-of-Concept) exploit maturity aligns with the publicly available exploit reference on GitHub. Against this, the impact metrics are all rated Low rather than High, which is unusual for SQL injection (which often yields full database read/write) and suggests VulDB scored impact conservatively. Signals are mild overall: there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active or widespread exploitation - only that exploit code exists. The affected product is an obscure individual-developer GitHub project (dhikshitha29/Insurance-Management-System) with no enterprise footprint, which substantially lowers real-world risk regardless of the network vector. One tension to verify: the vulnerable endpoint is /Admin/View/editPlan.php, an administrative path that in most real deployments would sit behind authentication, yet the vector asserts PR:N (unauthenticated) - this likely reflects the project's lack of real access control rather than a genuinely public admin panel, and should be verified against the actual code. Net assessment: a real but low-priority vulnerability, driven by the trivial exploitability of SQLi but heavily discounted by negligible deployment prevalence, absent exploitation evidence, and conservative impact scoring.

A remote attacker sends a crafted value in the Plan_no or Name parameter to /Admin/View/editPlan.php, which is concatenated unsanitized into a mysqli_query call, injecting arbitrary SQL. A proof-of-concept is publicly available (referenced via the project's GitHub issue tracker), so weaponization effort is minimal. Given the low CVSS complexity (AC:L) and no required interaction, the attacker could enumerate or manipulate insurance plan records in the backing MySQL database.