CVE-2026-114243: SQL Injection in dhikshitha29 Insurance-Management-System
Description
CVE-2026-114243 is a medium severity SQL injection vulnerability in the dhikshitha29 Insurance-Management-System. It affects the mysqli_query function in the /Agent/ManagePolicy/EditPolicyHolder.php file, where manipulation of the Policy_no or Name arguments can lead to SQL injection. The vulnerability can be exploited remotely and a public exploit is available. The product uses a rolling release model, so specific affected versions are not provided. The vendor has been notified but has not yet responded or issued a fix.
CVSS v4.0
Score 6.9medium
Affected software
dhikshitha29
Insurance-Management-System
cpe:2.3:a:dhikshitha29:insurance-management-system:*:*:*:*:*:*:*:*AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability allows an attacker to perform SQL injection via the Policy_no or Name parameters in the EditPolicyHolder.php script of the dhikshitha29 Insurance-Management-System. The flaw exists in the use of mysqli_query without proper input sanitization or parameterization, enabling remote attackers to manipulate SQL queries. The product's rolling release strategy prevents clear identification of affected versions. No vendor response or patch is currently available. A public exploit has been released, increasing the risk of exploitation.
Potential Impact
Successful exploitation can lead to unauthorized SQL query execution, potentially allowing attackers to access, modify, or delete database information remotely. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity), indicating significant but not critical impact. No evidence of active exploitation in the wild is reported yet.
Mitigation Recommendations
No official fix or patch is currently available as the vendor has not responded. Users should monitor the vendor's communications for updates. Until a patch is released, consider implementing application-level input validation or web application firewalls to mitigate SQL injection risks. Avoid exposing the vulnerable endpoint to untrusted networks if possible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-10-21T06:50:22.318Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad8b1502cdf04f656ecd9b9
Added to database: 10/21/2026, 12:34:24 UTC
Last enriched: 10/21/2026, 12:49:57 UTC
Last updated: 10/21/2026, 13:40:20 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.