CVE-2026-114248
Deferred Deferred - Pending Action

Authentication Bypass in Insurance-Management-System

Publication date: 2026-10-21

Last updated on: 2026-10-21

Assigner: VulDB

Description
A security vulnerability has been detected in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. This affects an unknown part of the file /Admin/includes/AddNewPlan-inc.php of the component Plan Management Form. The manipulation of the argument submit/Plan_no/Name leads to missing authentication. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-21
Last Modified
2026-10-21
Generated
2026-11-10
AI Q&A
2026-10-21
EPSS Evaluated
2026-11-09
NVD
CVE-2026-114248
EUVD
EUVD-2026-107257

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183
dhikshitha29 Insurance-Management-System 125362cc21dca20d74091a4913a5096bb58dd837

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a missing authentication issue in the Insurance-Management-System. It affects the Plan Management Form component, specifically the /Admin/includes/AddNewPlan-inc.php file. The vulnerability allows remote attackers to manipulate arguments like submit, Plan_no, and Name without proper authentication, potentially leading to unauthorized actions.

Detection Guidance

Check for unauthorized POST requests to /Admin/includes/AddNewPlan-inc.php and /Admin/includes/changePlan-inc.php. Monitor server logs for suspicious activity targeting these endpoints. Use tools like curl to test if the endpoints accept requests without authentication: curl -X POST http://<target>/Admin/includes/AddNewPlan-inc.php -d 'submit=test&Plan_no=1&Name=test'

Inspect network traffic for HTTP POST requests to these PHP files. Verify if the application performs session validation before processing requests to these endpoints.

Impact Analysis

This vulnerability could allow attackers to create or modify insurance plans without authorization. This may lead to financial fraud, policy manipulation, or corruption of business logic. Since the system handles insurance-related data, unauthorized changes could affect policyholders and the integrity of the entire system.

Compliance Impact

This vulnerability allows unauthenticated users to create or modify insurance plans, which could lead to unauthorized changes in sensitive data. For GDPR, this may violate principles of data integrity and security, potentially leading to unauthorized processing of personal data. For HIPAA, it risks exposing protected health information if insurance plans contain such data, compromising confidentiality and integrity requirements.

Mitigation Strategies

Immediately restrict access to /Admin/includes/AddNewPlan-inc.php and /Admin/includes/changePlan-inc.php by implementing authentication checks. Update the PHP scripts to validate user sessions before processing requests.

Apply network-level restrictions to block external access to admin endpoints. Consider temporarily disabling the affected functionality until proper authentication is implemented.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-114248. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...