# CVE-2026-114248: dhikshitha29 Insurance-Management-System missing authentication in plan management

Source: https://junglewise.ai/threats/cve-2026-114248-a-security-vulnerability-has-been-detected-in-dhikshitha29  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-114248 · Severity: medium · CVSS 5.3 · Published 2026-10-21

An insurance management system written in PHP lacks authentication checks in its plan management backend scripts. An unauthenticated attacker can remotely create new insurance plans or modify existing ones by submitting direct requests to the vulnerable scripts, potentially affecting the integrity of the insurance product database and customer records.

Technologies: [Dhikshitha29 Insurance-Management-System](https://junglewise.ai/threats/technologies/insurance-management-system). Vendors: [Dhikshitha29](https://junglewise.ai/threats/vendors/dhikshitha29).

## Quick answers

**Is CVE-2026-114248 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114248 being exploited in the wild.

**How severe is CVE-2026-114248?** Medium severity, with a CVSS score of 5.3, published 21 October 2026.

**Which products and versions are affected?** Dhikshitha29 Insurance-Management-System commit 125362cc21dca20d74091a4913a5096bb58dd837 and prior.

**Is there a fix for CVE-2026-114248?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-114248 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-114248?** Check whether you run Dhikshitha29 Insurance-Management-System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The plan management backend scripts (AddNewPlan-inc.php and changePlan-inc.php) perform database INSERT and UPDATE operations without verifying session authentication or authorization. An unauthenticated attacker can invoke these scripts directly via HTTP POST requests, bypassing the admin interface's access controls. No patched version is available; the project uses rolling release and has not yet responded to the issue report.

## Affected products

- dhikshitha29 Insurance-Management-System commit 125362cc21dca20d74091a4913a5096bb58dd837 and prior

## Timeline

- 2026-10-07: disclosed: Issue #5 opened on GitHub
- 2026-10-21: advisory

## References

- [https://github.com/dhikshitha29/Insurance-Management-System/](https://github.com/dhikshitha29/Insurance-Management-System/)
- [https://github.com/dhikshitha29/Insurance-Management-System/issues/5](https://github.com/dhikshitha29/Insurance-Management-System/issues/5)

## Related threats

- [dhikshitha29 Insurance-Management-System authorization bypass in policy holder update](https://junglewise.ai/threats/cve-2026-114249-a-vulnerability-was-detected-in-dhikshitha29-insurance)
- [Insurance Management System missing authentication in admin registration](https://junglewise.ai/threats/cve-2026-114245-a-weakness-has-been-identified-in-dhikshitha29-insurance)
- [dhikshitha29 Insurance-Management-System SQL injection in EditPolicyHolder.php](https://junglewise.ai/threats/cve-2026-114243-a-security-flaw-has-been-discovered-in-dhikshitha29-insurance)
- [dhikshitha29 Insurance-Management-System SQL injection in editPlan.php](https://junglewise.ai/threats/cve-2026-114242-a-vulnerability-was-identified-in-dhikshitha29-insurance)