CVE-2026-114242: SQL Injection in dhikshitha29 Insurance-Management-System

This vulnerability affects the dhikshitha29 Insurance-Management-System in the mysqli_query function of /Admin/View/editPlan.php. An attacker can manipulate the Plan_no or Name arguments to perform SQL injection attacks remotely. The product's rolling release model means no explicit version information is available for affected or patched releases. The issue was responsibly disclosed to the project, but no vendor response or patch has been published. The CVSS 4.0 base score is 6.9, indicating a medium severity risk with network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts.

Successful exploitation allows remote attackers to execute arbitrary SQL commands via manipulated input parameters, potentially leading to unauthorized data access or modification. The impact is limited to low confidentiality, integrity, and availability loss as per the CVSS vector. No active exploitation in the wild has been reported yet.

No official fix or patch is currently available from the vendor. Since the vendor has not responded or issued remediation, users should apply general SQL injection mitigations such as input validation, parameterized queries, or web application firewalls as interim measures. Monitor vendor channels for updates and apply patches promptly once available.