EUVD-2025-18436Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to application
-
DeliverySend crafted POST to /insertNominee.php
-
ExploitInject SQL via client_id parameter
-
ExecutionExtract database contents
-
ImpactCompromise data confidentiality
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | The attacker must have low-privilege access (PR:L) to the application, as indicated by the CVSS vector. No special configuration is required; the vulnerability exists in the default installation. The attack is remote over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N). |
| Impact | CVSS 4.0 base score is 2.1 (Low) with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L, indicating low impact on confidentiality, integrity, and availability. EPSS score is 0.07% (percentile 22%), suggesting low exploitation probability. Public exploit code exists, but no CISA KEV listing. The low CVSS score and EPSS indicate limited real-world risk, though the presence of public exploits increases risk for unpatched instances. |
| Exploit ScenarioDerived | An attacker with low-privilege access to the Life Insurance Management System sends a crafted HTTP POST request to /insertNominee.php with malicious SQL in the client_id parameter. The application executes the injected SQL, allowing the attacker to extract sensitive data from the database. Public exploit code is available, simplifying the attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 26, 2026
SQL injection in Projectworlds Life Insurance Management System 1.0 allows remote authenticated attackers to execute arbitrary SQL commands via the client_id or nominee_id parameters in /insertNominee.php. Public exploit code is available, but no active exploitation has been confirmed. EPSS score is low (0.07%), indicating limited exploitation likelihood.
Earlier versions of this analysis (1)
RemediationAI
No vendor-released patch identified at time of analysis. As a workaround, sanitize and parameterize all user inputs in /insertNominee.php, especially the client_id and nominee_id parameters. Implement web application firewall (WAF) rules to block SQL injection patterns. Restrict access to the /insertNominee.php endpoint to authenticated users only, and consider disabling the feature if not needed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a SQL injection (CWE-74) in a PHP-based web application. The affected product is Projectworlds Life Insurance Management System version 1.0, identified by CPE cpe:2.3:a:projectworlds:life_insurance_management_system:1.0. The flaw exists in the /insertNominee.php script, where user-supplied input is not properly sanitized before being used in SQL queries, allowing an attacker to manipulate database queries.
Know when Life Insurance Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
PR:L due to authentication required; C:L/I:L as SQLi can read/write data but not full control.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was found in Projectworlds Life Insurance Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /insertNominee.php. The manipulation of the argument client_id/nominee_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Executive ViewAI
Organizations using A vulnerability should be aware of moderate risk from CVE-2025-6135, a injection vulnerability rated CVSS 6.3. Exploitation could allow attackers to execute code or inject malicious input. Proof-of-concept code is publicly available. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: deploy WAF rules, restrict network access, enable logging.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
A vulnerability classified as critical was found in SourceCodester Life Insurance Management System 1.0. Rated critical
Aegon Life v1.0 was discovered to contain a SQL injection vulnerability via the client_id parameter at clientStatus.php.
A vulnerability was found in projectworlds Life Insurance Management System 1.0 and classified as critical.php. Rated me
A vulnerability, which was classified as critical, was found in projectworlds Life Insurance Management System 1.0. Rate
A vulnerability, which was classified as critical, has been found in projectworlds Life Insurance Management System 1.0.
A vulnerability classified as critical was found in projectworlds Life Insurance Management System 1.0. Rated medium sev
A vulnerability has been found in projectworlds Life Insurance Management System 1.0 and classified as critical. Rated m
A vulnerability classified as critical has been found in projectworlds Life Insurance Management System 1.0. Rated mediu
A cross-site scripting (XSS) vulnerability in Aegon Life v1.0 allows attackers to execute arbitrary web scripts or HTML
A vulnerability was found in SourceCodester Life Insurance Management System 1.0. Rated medium severity (CVSS 6.1), this
A vulnerability was found in Project Worlds Life Insurance Management System 1.0. Rated medium severity (CVSS 5.3), this
A vulnerability was found in Project Worlds Life Insurance Management System 1.0. Rated medium severity (CVSS 5.3), this
Exploit-DB