CVE-2026-112090

MediumCVSS 6.3

Published: 19/10/2026(UTC)Updated: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

9th percentile - higher than 9% of all known CVEs

Summary

A SQL injection vulnerability has been found in dairy-management-system (Dav-ee) in payment/pay.php. Manipulation of the f_no/farmer arguments in the mysqli_real_escape_string function allows remote execution of SQL queries. The exploit is public and may be used.

Risk Assessment

An attacker could remotely execute arbitrary SQL queries, potentially leading to data leakage, modification, or deletion. Lack of version information makes risk assessment difficult.

Recommendation

Update the application to the latest version or implement parameterized queries and input validation in payment/pay.php. Monitor the project's communications for patches.

Other vulnerabilities in dairy-management-system

CVE-2026-112091Medium
An information disclosure vulnerability has been found in dairy-management-system (Dav-ee) in delivery/checkfarmer.json.php, within the AJAX Endpoint component. Manipulation of the fname argument allows remote disclosure of information. The exploit has been published and may be used.

Original NVD description (English source)

A vulnerability was detected in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. This issue affects the function mysqli_real_escape_string of the file payment/pay.php. The manipulation of the argument f_no/farmer results in sql injection. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS