Insurance Management System CVE-2026-114245

Requires a reachable deployment of dhikshitha29 Insurance-Management-System exposing /Admin/includes/Admin-Register-inc.php (the Add New Admin Form). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation is remote, unauthenticated, requires no user interaction, and works against the default application flow by tampering with the submit/Admin_id/password request arguments. The principal limiting factor is exposure, not configuration: the component must be network-accessible, and impact is limited to partial confidentiality/integrity/availability (unauthorized admin registration) rather than full takeover. No version-based scoping is possible due to the undisclosed rolling-release model.

This is a genuinely medium/low real-world risk despite being remotely exploitable. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates a network-reachable, low-complexity, unauthenticated flaw, but the impact metrics are deliberately modest (VC:L/VI:L/VA:L, no subsequent-system impact), yielding a 5.5 medium base score. The strongest aggravating signal is the publicly available exploit (E:P / POC=YES), which lowers the barrier to opportunistic abuse. However, there is NO CISA KEV listing and NO EPSS score provided in the input, so there is no evidence of active, widespread exploitation - exploitation is proof-of-concept only. The dominant mitigating factor is the target: dhikshitha29 Insurance-Management-System is an obscure individual GitHub project with no meaningful production footprint, so aggregate exposure is very small regardless of how easy the exploit is. No SSVC decision data was supplied. Net: treat as a low-priority medium - the public exploit warrants attention for any organization actually running this specific project, but it is not a broad fleet threat.

A remote, unauthenticated attacker sends a crafted POST request to /Admin/includes/Admin-Register-inc.php manipulating the submit, Admin_id, and password parameters to bypass authorization on the Add New Admin Form and register a new administrator account. A public proof-of-concept exists (linked from the project's GitHub issue tracker), so the request can be reproduced directly. Because CVSS impact is only partial (VC:L/VI:L/VA:L), the attacker gains limited unauthorized admin-registration capability rather than full system compromise.