Insurance Management System CVE-2026-114248

Exploitation requires network reachability to the application's /Admin/includes/AddNewPlan-inc.php endpoint of the Plan Management Form component; because the endpoint is missing an authentication check (CWE-287), an attacker simply submits the submit/Plan_no/Name parameters with no credentials, no user interaction, and no special configuration (AV:N/AC:L/PR:N/UI:N). The primary limiting factors are deployment-related rather than technical: the product is a niche, self-hosted GitHub project that must be publicly exposed to be reachable, impact is confined to integrity (plan-data modification, VI:L) with no confidentiality or availability effect, and no official patch exists since the project is rolling-release and the maintainer has not responded.

Signals are mixed but point to a genuinely low real-world priority despite a network-reachable unauthenticated flaw. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, low-complexity, pre-authentication exploitation, which normally elevates urgency - but the impact metrics are narrow: only VC:N/VI:L/VA:N, meaning no confidentiality or availability impact and only limited integrity impact, yielding a MEDIUM 5.5 base score. The E:P (Proof-of-Concept) threat metric aligns with the description's statement that an exploit has been publicly disclosed, so POC availability is confirmed; however, there is NO CISA KEV listing and NO EPSS score provided in the input, so widespread or automated exploitation cannot be asserted. No SSVC decision data was supplied. The affected product is an individual developer's GitHub project (dhikshitha29/Insurance-Management-System) with no enterprise footprint, which strongly bounds real-world exposure. Note a tension to verify: CWE-287 (missing authentication) combined with 'manipulation of the argument submit/Plan_no/Name' typically suggests an access-control/parameter-tampering issue affecting data integrity, consistent with VI:L and VC:N - but defenders should confirm with the referenced VulDB entry whether any read/exposure of data also occurs. Overall this is a high-visibility-but-low-impact issue on a niche product, not a fleet-wide emergency.

A remote attacker sends a crafted HTTP request directly to /Admin/includes/AddNewPlan-inc.php, which does not enforce authentication, and manipulates the submit/Plan_no/Name parameters to add or alter an insurance plan without valid admin credentials. A public proof-of-concept exists, and because no user interaction or authentication is required (AV:N/AC:L/PR:N/UI:N), the request can be issued against any reachable instance. The impact is limited to integrity (VI:L) - unauthorized modification of plan data - rather than full system compromise.