CVE-2024-31064
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
A Cross Site Scripting (XSS) vulnerability in Insurance Management System version 1.0.0 and earlier allows a remote attacker to execute arbitrary JavaScript code in the victim's browser via the "First Name" input field.
Risk Assessment
An attacker can hijack user sessions, steal sensitive data, or perform other malicious actions within the application context, posing a serious threat to data confidentiality and integrity.
Recommendation
Immediately update the system to the latest version and implement input validation and output encoding (e.g., HTML encoding) for all form fields.
Other vulnerabilities in Insurance Management System
See all- CVE-2026-114249High
A vulnerability was detected in Insurance-Management-System in unknown code of `/Agent/includes/UpdatePolicyHolder-inc.php` within the Policy Holder Update Form component. Manipulation of the `Policy_no` argument results in improper authorization. The attack can be launched remotely, and the exploit is now public.
- CVE-2026-114243High
A SQL injection vulnerability was found in the Insurance-Management-System within the mysqli_query function of /Agent/ManagePolicy/EditPolicyHolder.php. Manipulating the Policy_no/Name argument allows SQL injection. The flaw can be exploited remotely and a public exploit is available.
- CVE-2026-114242High
A vulnerability was identified in Insurance-Management-System in the `mysqli_query` function of `/Admin/View/editPlan.php`. Manipulation of the `Plan_no/Name` argument leads to SQL injection. The attack can be executed remotely, and the exploit is publicly available.
Original NVD description (English source)
Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the First Name input field.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS