High severity · published Oct 21, 2026
CVE-2026-114249
dhikshitha29 Insurance-Management-System Policy Holder Update Form UpdatePolicyHolder-inc.php improper authorization
7.3
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability was detected in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. This vulnerability affects unknown code of the file /Agent/includes/UpdatePolicyHolder-inc.php of the component Policy Holder Update Form. The manipulation of the argument Policy_no results in improper authorization. It is possible to launch the attack remotely. The exploit is now public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IN
Insurance-Management-System · dhikshitha29
91de5edda5baa109ad8e9baf03ce6a3ceda84183; 125362cc21dca20d74091a4913a5096bb58dd837 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-114249
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-114249
github.com
https://github.com/dhikshitha29/Insurance-Management-System/
github.com
https://github.com/dhikshitha29/Insurance-Management-System/issues/6
vuldb.com
https://vuldb.com/cve/CVE-2026-114249
vuldb.com
https://vuldb.com/submit/1018594
vuldb.com
https://vuldb.com/vuln/424681
vuldb.com
https://vuldb.com/vuln/424681/cti
More from Insurance-Management-System
7.3
CVE-2026-114245
dhikshitha29 Insurance-Management-System Add New Admin Form Admin-Register-inc.php improper authorization
7.3
CVE-2026-114243
dhikshitha29 Insurance-Management-System EditPolicyHolder.php mysqli_query sql injection
7.3
CVE-2026-114242
dhikshitha29 Insurance-Management-System editPlan.php mysqli_query sql injection
5.3
CVE-2026-114248
dhikshitha29 Insurance-Management-System Plan Management Form AddNewPlan-inc.php missing authentication
