Insurance Management System
Monthly
Improper authorization in the Policy Holder Update Form of dhikshitha29 Insurance-Management-System lets unauthenticated remote attackers update policy-holder records by manipulating the Policy_no parameter, and public exploit code exists. The project uses rolling releases, has no fixed version, and the maintainer has not responded to the issue report, so deployments exposing /Agent/includes/UpdatePolicyHolder-inc.php remain at risk unless they add authorization checks or block the endpoint. No CISA KEV listing confirms active exploitation at time of analysis.
Improper authorization in dhikshitha29 Insurance Management System lets remote, unauthenticated attackers create a new administrator account by manipulating the submit, Admin_id, and password parameters sent to /Admin/includes/Admin-Register-inc.php. The project uses a rolling-release model, so no fixed or affected version can be scoped; publicly available exploit code exists and the vendor has not responded to the report. With a CVSS score of 5.5 (medium), impact is limited to partial confidentiality, integrity, and availability rather than full system compromise.
SQL injection in the dhikshitha29 Insurance-Management-System agent policy editor (EditPolicyHolder.php) lets remote attackers manipulate the Policy_no and Name parameters, which are concatenated directly into a mysqli_query call, potentially exposing or altering policy-holder records. The project is a niche open-source PHP application maintained on a rolling release with no published fixed version and an unresponsive maintainer, and publicly available exploit code exists. The supplied CVSS vector indicates no required privileges (PR:N) and no user interaction, but because the affected script resides under /Agent/ManagePolicy/, realistic exploitation likely requires an authenticated agent-portal session; authentication requirements are not definitively confirmed from the available data, and production exposure is expected to be minimal.
SQL injection in the dhikshitha29 Insurance-Management-System PHP application lets remote attackers inject arbitrary SQL through the Plan_no and Name parameters handled by mysqli_query() in /Admin/View/editPlan.php. The application is a niche, single-developer project distributed as a rolling release with no versioned tags, so the exact affected build range cannot be pinned beyond the referenced commits (91de5edda5baa109ad8e9baf03ce6a3ceda84183 and 125362cc21dca20d74091a4913a5096bb58dd837), and no vendor fix exists because the maintainer has not responded to the upstream issue report. Publicly available exploit code exists and the reporter (VulDB) documents the issue publicly, though there is no confirmed evidence of active exploitation (no CISA KEV listing); real-world risk is constrained mainly by the product's very small production footprint, and secondarily by the fact that the vulnerable endpoint sits under an /Admin/ path that some deployments may gate behind admin authentication.
SQL injection in itsourcecode Insurance Management System 1.0 allows authenticated remote attackers to manipulate the agent_id parameter in /updateAgent.php, enabling unauthorized database queries with limited confidentiality and integrity impact. Despite critical classification in metadata, the CVSS 4.0 vector shows low severity (2.1 score) due to requirement for prior authentication and restricted scope. Public exploit code is available, though EPSS score of 0.06% (20th percentile) suggests minimal real-world exploitation likelihood.
SQL injection in itsourcecode Insurance Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the recipt_no parameter in /insertPayment.php, resulting in limited confidentiality and integrity impact. The vulnerability requires valid user credentials (PR:L) and carries a low CVSS score of 2.1 despite being classified critical by the discoverer. Exploit code is publicly available and has been disclosed, though no active widespread exploitation has been reported.
SQL injection in itsourcecode Insurance Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the nominee_id parameter in /insertNominee.php, resulting in limited confidentiality and integrity impact. Publicly available exploit code exists, though EPSS scoring (0.09th percentile) suggests minimal real-world exploitation likelihood despite the critical classification and public disclosure.
SQL injection in itsourcecode Insurance Management System up to version 1.0 allows remote attackers to inject arbitrary SQL commands via the agent_id parameter in the /insertAgent.php endpoint. Publicly available exploit code exists, though EPSS indicates low exploitation probability (0.04%) and no active exploitation is confirmed in CISA KEV. The vulnerability can lead to unauthorized database access and data manipulation.
A vulnerability has been found in SourceCodester Insurance Management System 1.0 and classified as problematic. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in SourceCodester Insurance Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in SourceCodester Insurance Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as problematic has been found in SourceCodester Insurance Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross Site Scripting (XSS) in Insurance Management System v1.0, allows remote attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Category Name parameter at. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the City input field. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the First Name input field. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the Email input field. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the Street input field. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the Last Name input field. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross Site Scripting (XSS) vulnerability in Sourcecodester Insurance Management System 1.0 allows attackers to run arbitrary code via the Subject and Description fields when submitting a support. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability, which was classified as critical, has been found in SourceCodester Insurance Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Insurance Management System 1.0 is vulnerable to SQL Injection via /insurance/editNominee.php?nominee_id=. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Insurance Management System 1.0 is vulnerable to SQL Injection via /insurance/editAgent.php?agent_id=. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Insurance Management System 1.0 is vulnerable to SQL Injection via /insurance/editPayment.php?recipt_no=. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Insurance Management System 1.0 is vulnerable to SQL Injection via /insurance/editClient.php?client_id=. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Insurance Management System 1.0 is vulnerable to SQL Injection via /insurance/clientStatus.php?client_id=. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Insurance Management System 1.0 was discovered to contain a SQL injection vulnerability via the username parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Improper authorization in the Policy Holder Update Form of dhikshitha29 Insurance-Management-System lets unauthenticated remote attackers update policy-holder records by manipulating the Policy_no parameter, and public exploit code exists. The project uses rolling releases, has no fixed version, and the maintainer has not responded to the issue report, so deployments exposing /Agent/includes/UpdatePolicyHolder-inc.php remain at risk unless they add authorization checks or block the endpoint. No CISA KEV listing confirms active exploitation at time of analysis.
Improper authorization in dhikshitha29 Insurance Management System lets remote, unauthenticated attackers create a new administrator account by manipulating the submit, Admin_id, and password parameters sent to /Admin/includes/Admin-Register-inc.php. The project uses a rolling-release model, so no fixed or affected version can be scoped; publicly available exploit code exists and the vendor has not responded to the report. With a CVSS score of 5.5 (medium), impact is limited to partial confidentiality, integrity, and availability rather than full system compromise.
SQL injection in the dhikshitha29 Insurance-Management-System agent policy editor (EditPolicyHolder.php) lets remote attackers manipulate the Policy_no and Name parameters, which are concatenated directly into a mysqli_query call, potentially exposing or altering policy-holder records. The project is a niche open-source PHP application maintained on a rolling release with no published fixed version and an unresponsive maintainer, and publicly available exploit code exists. The supplied CVSS vector indicates no required privileges (PR:N) and no user interaction, but because the affected script resides under /Agent/ManagePolicy/, realistic exploitation likely requires an authenticated agent-portal session; authentication requirements are not definitively confirmed from the available data, and production exposure is expected to be minimal.
SQL injection in the dhikshitha29 Insurance-Management-System PHP application lets remote attackers inject arbitrary SQL through the Plan_no and Name parameters handled by mysqli_query() in /Admin/View/editPlan.php. The application is a niche, single-developer project distributed as a rolling release with no versioned tags, so the exact affected build range cannot be pinned beyond the referenced commits (91de5edda5baa109ad8e9baf03ce6a3ceda84183 and 125362cc21dca20d74091a4913a5096bb58dd837), and no vendor fix exists because the maintainer has not responded to the upstream issue report. Publicly available exploit code exists and the reporter (VulDB) documents the issue publicly, though there is no confirmed evidence of active exploitation (no CISA KEV listing); real-world risk is constrained mainly by the product's very small production footprint, and secondarily by the fact that the vulnerable endpoint sits under an /Admin/ path that some deployments may gate behind admin authentication.
SQL injection in itsourcecode Insurance Management System 1.0 allows authenticated remote attackers to manipulate the agent_id parameter in /updateAgent.php, enabling unauthorized database queries with limited confidentiality and integrity impact. Despite critical classification in metadata, the CVSS 4.0 vector shows low severity (2.1 score) due to requirement for prior authentication and restricted scope. Public exploit code is available, though EPSS score of 0.06% (20th percentile) suggests minimal real-world exploitation likelihood.
SQL injection in itsourcecode Insurance Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the recipt_no parameter in /insertPayment.php, resulting in limited confidentiality and integrity impact. The vulnerability requires valid user credentials (PR:L) and carries a low CVSS score of 2.1 despite being classified critical by the discoverer. Exploit code is publicly available and has been disclosed, though no active widespread exploitation has been reported.
SQL injection in itsourcecode Insurance Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the nominee_id parameter in /insertNominee.php, resulting in limited confidentiality and integrity impact. Publicly available exploit code exists, though EPSS scoring (0.09th percentile) suggests minimal real-world exploitation likelihood despite the critical classification and public disclosure.
SQL injection in itsourcecode Insurance Management System up to version 1.0 allows remote attackers to inject arbitrary SQL commands via the agent_id parameter in the /insertAgent.php endpoint. Publicly available exploit code exists, though EPSS indicates low exploitation probability (0.04%) and no active exploitation is confirmed in CISA KEV. The vulnerability can lead to unauthorized database access and data manipulation.
A vulnerability has been found in SourceCodester Insurance Management System 1.0 and classified as problematic. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in SourceCodester Insurance Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in SourceCodester Insurance Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as problematic has been found in SourceCodester Insurance Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross Site Scripting (XSS) in Insurance Management System v1.0, allows remote attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Category Name parameter at. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the City input field. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the First Name input field. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the Email input field. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the Street input field. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the Last Name input field. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross Site Scripting (XSS) vulnerability in Sourcecodester Insurance Management System 1.0 allows attackers to run arbitrary code via the Subject and Description fields when submitting a support. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability, which was classified as critical, has been found in SourceCodester Insurance Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Insurance Management System 1.0 is vulnerable to SQL Injection via /insurance/editNominee.php?nominee_id=. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Insurance Management System 1.0 is vulnerable to SQL Injection via /insurance/editAgent.php?agent_id=. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Insurance Management System 1.0 is vulnerable to SQL Injection via /insurance/editPayment.php?recipt_no=. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Insurance Management System 1.0 is vulnerable to SQL Injection via /insurance/editClient.php?client_id=. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Insurance Management System 1.0 is vulnerable to SQL Injection via /insurance/clientStatus.php?client_id=. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Insurance Management System 1.0 was discovered to contain a SQL injection vulnerability via the username parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.