CVE-2026-114242: dhikshitha29 Insurance-Management-System editPlan.php mysqli_query sql injection
A vulnerability was identified in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected is the function mysqliquery of the file /Admin/View/editPlan.php. Such manipulation of the argument Planno/Name leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Does exploitation require an authenticated account or user interaction?
No. The reported attack is remote and the supplied vector indicates no privileges and no user interaction are required.
How likely is active exploitation?
A public exploit is available, and the report states it might be used. Internet-reachable deployments should be prioritized for review.
How can I determine whether my deployment is in scope?
Version-based determination is not available because the project uses a rolling release. Compare your source state with the identified revisions 91de5edda5baa109ad8e9baf03ce6a3ceda84183 and 125362cc21dca20d74091a4913a5096bb58dd837, and inspect /Admin/View/editPlan.php.
Is there a confirmed maintainer response or fixed release?
The project was notified through an issue report but had not responded at the time of the report. No fixed release or updated-version information is provided.