CVE-2025-6136

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in Projectworlds Life Insurance Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /insertPayment.php. The manipulation of the argument recipt_no leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
Projectworlds	Life Insurance Management System	1.0

References

https://github.com/YZS17/CVE/blob/main/Life_Insurance_Management_System/sqli_insertPayment.php.mdExploit, Third Party Advisory
https://github.com/YZS17/CVE/blob/main/Life_Insurance_Management_System/sqli_insertPayment.php.md#pocExploit, Third Party Advisory
https://vuldb.com/?ctiid.312605Permissions Required, VDB Entry
https://vuldb.com/?id.312605Third Party Advisory, VDB Entry
https://vuldb.com/?submit.592842Third Party Advisory, VDB Entry

Timeline

Published: Jun 16, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-61378.8A vulnerability classified as critical has been found in TOTOLINK T10 4.1.8cu.5207. Affected is the function setWiFiScheduleCfg of the file CVE-2025-61388.8A vulnerability classified as critical was found in TOTOLINK T10 4.1.8cu.5207. Affected by this vulnerability is the function setWizardCfg o CVE-2025-613859.6SQL injection vulnerability in tlocke pg8000 1.31.4 allows remote attackers to execute arbitrary SQL commands via a specially crafted Python CVE-2025-61393.9A vulnerability, which was classified as problematic, has been found in TOTOLINK T10 4.1.8cu.5207. Affected by this issue is some unknown fu CVE-2025-61403.3A vulnerability, which was classified as problematic, was found in spdlog up to 1.15.1. This affects the function scoped_padder in the libra CVE-2025-61413.3A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function post CVE-2025-614136.1A stored cross-site scripting (XSS) vulnerability in the /manager/pages component of Piranha CMS v12.0 allows attackers to execute arbitrary CVE-2025-614178.8Cross-Site Scripting (XSS) vulnerability exists in TastyIgniter 3.7.7, affecting the /admin/media_manager component. Attackers can upload a CVE-2025-61426.3A vulnerability was found in Intera InHire up to 20250530. It has been declared as critical. Affected by this vulnerability is an unknown fu CVE-2025-614276.1A reflected cross-site scripting (XSS) vulnerability in BEO GmbH BEO Atlas Einfuhr Ausfuhr 3.0 allows attackers to execute arbitrary code in CVE-2025-614298.8An issue in NCR Atleos Terminal Manager (ConfigApp) v3.4.0 allows attackers to escalate privileges via a crafted request.CVE-2025-61438.8A vulnerability, which was classified as critical, was found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713. Affected is an unknown function of