Live › vulnerability › CVE-2026-114249
Go to dashboardA PHP file in the dhikshitha29 Insurance-Management-System project accepts a Policy_no argument without proper authorization checks. A remote attacker can manipulate that value to act on policies they should not be able to change, and a public exploit exists.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Anyone running this PHP/MySQL insurance management app (dhikshitha29/Insurance-Management-System) with the Agent directory reachable over a network. No login is needed: anyone can overwrite any policy holder's name, contact details, address and nominee by guessing sequential Policy_no values. Teams not running this project can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Insurance-Management-System | github | commits 91de5edda5baa109ad8e9baf03ce6a3ceda84183, 125362cc21dca20d74091a4913a5096bb58dd837 | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was detected in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. This vulnerability affects unknown code of the file /Agent/includes/UpdatePolicyHolder-inc.php of the component Policy Holder Update Form. The manipulation of the argument Policy_no results in improper authorization. It is possible to launch the attack remotely. The exploit is now public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-114249")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.