Insurance-Management-System: SQL injection in editPlan.php (CVE-2026-114242)
A SQL injection vulnerability exists in the Insurance-Management-System project due to manipulation of the Plan_no/Name argument in /Admin/View/editPlan.php.
CVE search metadata
CVE search record: CVE-2026-114242. Severity: high. CVSS: 7.3. KEV: no. Product: Insurance-Management-System (rolling release). Brief: Insurance-Management-System: SQL injection in editPlan.php (CVE-2026-114242). Brief link: https://feed.craftedsignal.io/briefs/2026-10-insurance-management-sql-injection/
Triage facts
Revision 1- Applicability
- Insurance-Management-System (rolling release)
- Evidence
- Unknown
- Severity
- High
- Sources
- 2 public sources
- Freshness
- Revision 1Oct 21, 13:18 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
A vulnerability was identified in dhikshitha29 Insurance-Management-System (commit 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837). The function mysqli_query in /Admin/View/editPlan.php is susceptible to SQL injection via the Plan_no or Name argument. The attack can be executed remotely, and a public exploit is available. The project uses a rolling release model, and no fix has been provided by the maintainer.