Search
Find a vulnerability
Search criteria
8 vulnerabilities by Dav-ee
CVE-2026-112091 (GCVE-0-2026-112091)
Vulnerability from nvd – Published: 2026-10-19 07:15 – Updated: 2026-10-19 07:15
VLAI
EPSS
VEX
Title
Dav-ee dairy-management-system AJAX Endpoint checkfarmer.json.php information disclosure
Summary
A flaw has been found in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. Impacted is an unknown function of the file delivery/checkfarmer.json.php of the component AJAX Endpoint. This manipulation of the argument fname causes information disclosure. Remote exploitation of the attack is possible. The exploit has been published and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/421856 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/421856/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-112091 | third-party-advisory |
| https://vuldb.com/submit/1011470 | third-party-advisory |
| https://github.com/Dav-ee/dairy-management-system… | exploitissue-tracking |
| https://github.com/Dav-ee/dairy-management-system/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Dav-ee | dairy-management-system |
Affected:
31ace9692d1e1e6d64339a42c463b361319c615c
Affected: f31a584c3330c013b61f8b0306d9e0849c6d693d cpe:2.3:a:dav-ee:dairy-management-system:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:dav-ee:dairy-management-system:*:*:*:*:*:*:*:*"
],
"modules": [
"AJAX Endpoint"
],
"product": "dairy-management-system",
"vendor": "Dav-ee",
"versions": [
{
"status": "affected",
"version": "31ace9692d1e1e6d64339a42c463b361319c615c"
},
{
"status": "affected",
"version": "f31a584c3330c013b61f8b0306d9e0849c6d693d"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Elymas (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. Impacted is an unknown function of the file delivery/checkfarmer.json.php of the component AJAX Endpoint. This manipulation of the argument fname causes information disclosure. Remote exploitation of the attack is possible. The exploit has been published and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Information Disclosure",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T07:15:15.643Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-421856 | Dav-ee dairy-management-system AJAX Endpoint checkfarmer.json.php information disclosure",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/421856"
},
{
"name": "VDB-421856 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/421856/cti"
},
{
"name": "CVE-2026-112091 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-112091"
},
{
"name": "Submit #1011470 | Dav-ee dairy-management-system f31a584c3330c013b61f8b0306d9e0849c6d693d Exposure of Private Personal Information to an Unauthorized Acto",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1011470"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/Dav-ee/dairy-management-system/issues/5"
},
{
"tags": [
"product"
],
"url": "https://github.com/Dav-ee/dairy-management-system/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-18T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-18T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-18T18:31:09.000Z",
"value": "VulDB entry last update"
}
],
"title": "Dav-ee dairy-management-system AJAX Endpoint checkfarmer.json.php information disclosure",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-112091",
"datePublished": "2026-10-19T07:15:15.643Z",
"dateReserved": "2026-10-18T16:25:49.328Z",
"dateUpdated": "2026-10-19T07:15:15.643Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112090 (GCVE-0-2026-112090)
Vulnerability from nvd – Published: 2026-10-19 07:00 – Updated: 2026-10-19 17:29
VLAI
EPSS
VEX
Title
Dav-ee dairy-management-system pay.php mysqli_real_escape_string sql injection
Summary
A vulnerability was detected in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. This issue affects the function mysqli_real_escape_string of the file payment/pay.php. The manipulation of the argument f_no/farmer results in sql injection. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 17:28 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/421855 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/421855/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-112090 | third-party-advisory |
| https://vuldb.com/submit/1011469 | third-party-advisory |
| https://github.com/Dav-ee/dairy-management-system… | exploitissue-tracking |
| https://github.com/Dav-ee/dairy-management-system/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Dav-ee | dairy-management-system |
Affected:
31ace9692d1e1e6d64339a42c463b361319c615c
Affected: f31a584c3330c013b61f8b0306d9e0849c6d693d cpe:2.3:a:dav-ee:dairy-management-system:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112090",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T17:28:41.487226Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T17:29:00.886Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:dav-ee:dairy-management-system:*:*:*:*:*:*:*:*"
],
"product": "dairy-management-system",
"vendor": "Dav-ee",
"versions": [
{
"status": "affected",
"version": "31ace9692d1e1e6d64339a42c463b361319c615c"
},
{
"status": "affected",
"version": "f31a584c3330c013b61f8b0306d9e0849c6d693d"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Elymas (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. This issue affects the function mysqli_real_escape_string of the file payment/pay.php. The manipulation of the argument f_no/farmer results in sql injection. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T07:00:11.646Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-421855 | Dav-ee dairy-management-system pay.php mysqli_real_escape_string sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/421855"
},
{
"name": "VDB-421855 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/421855/cti"
},
{
"name": "CVE-2026-112090 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-112090"
},
{
"name": "Submit #1011469 | Dav-ee dairy-management-system f31a584c3330c013b61f8b0306d9e0849c6d693d SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1011469"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/Dav-ee/dairy-management-system/issues/4"
},
{
"tags": [
"product"
],
"url": "https://github.com/Dav-ee/dairy-management-system/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-18T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-18T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-18T18:31:05.000Z",
"value": "VulDB entry last update"
}
],
"title": "Dav-ee dairy-management-system pay.php mysqli_real_escape_string sql injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-112090",
"datePublished": "2026-10-19T07:00:11.646Z",
"dateReserved": "2026-10-18T16:25:45.738Z",
"dateUpdated": "2026-10-19T17:29:00.886Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112089 (GCVE-0-2026-112089)
Vulnerability from nvd – Published: 2026-10-19 06:45 – Updated: 2026-10-19 16:36
VLAI
EPSS
VEX
Title
Dav-ee dairy-management-system delete.php mysqli_query sql injection
Summary
A security vulnerability has been detected in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. This vulnerability affects the function mysqli_query of the file employees/delete.php. The manipulation of the argument e_payroll_no leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 15:57 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/421854 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/421854/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-112089 | third-party-advisory |
| https://vuldb.com/submit/1011415 | third-party-advisory |
| https://github.com/Dav-ee/dairy-management-system… | exploitissue-tracking |
| https://github.com/Dav-ee/dairy-management-system/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Dav-ee | dairy-management-system |
Affected:
31ace9692d1e1e6d64339a42c463b361319c615c
Affected: f31a584c3330c013b61f8b0306d9e0849c6d693d cpe:2.3:a:dav-ee:dairy-management-system:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112089",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T15:57:56.449687Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:36:20.414Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:dav-ee:dairy-management-system:*:*:*:*:*:*:*:*"
],
"product": "dairy-management-system",
"vendor": "Dav-ee",
"versions": [
{
"status": "affected",
"version": "31ace9692d1e1e6d64339a42c463b361319c615c"
},
{
"status": "affected",
"version": "f31a584c3330c013b61f8b0306d9e0849c6d693d"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "7z2Z (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. This vulnerability affects the function mysqli_query of the file employees/delete.php. The manipulation of the argument e_payroll_no leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.8,
"vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T06:45:16.887Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-421854 | Dav-ee dairy-management-system delete.php mysqli_query sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/421854"
},
{
"name": "VDB-421854 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/421854/cti"
},
{
"name": "CVE-2026-112089 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-112089"
},
{
"name": "Submit #1011415 | Dav-ee dairy-management-system f31a584c3330c013b61f8b0306d9e0849c6d693d SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1011415"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/Dav-ee/dairy-management-system/issues/3"
},
{
"tags": [
"product"
],
"url": "https://github.com/Dav-ee/dairy-management-system/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-18T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-18T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-18T18:31:00.000Z",
"value": "VulDB entry last update"
}
],
"title": "Dav-ee dairy-management-system delete.php mysqli_query sql injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-112089",
"datePublished": "2026-10-19T06:45:16.887Z",
"dateReserved": "2026-10-18T16:25:42.191Z",
"dateUpdated": "2026-10-19T16:36:20.414Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112088 (GCVE-0-2026-112088)
Vulnerability from nvd – Published: 2026-10-19 06:30 – Updated: 2026-10-19 16:46
VLAI
EPSS
VEX
Title
Dav-ee dairy-management-system add.php mysqli_query sql injection
Summary
A weakness has been identified in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. This affects the function mysqli_query of the file farmers/add.php. Executing a manipulation of the argument f_no/f_id/f_name/f_locallity/f_ac/f_phone can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 16:46 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/421853 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/421853/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-112088 | third-party-advisory |
| https://vuldb.com/submit/1011414 | third-party-advisory |
| https://github.com/Dav-ee/dairy-management-system… | exploitissue-tracking |
| https://github.com/Dav-ee/dairy-management-system/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Dav-ee | dairy-management-system |
Affected:
31ace9692d1e1e6d64339a42c463b361319c615c
Affected: f31a584c3330c013b61f8b0306d9e0849c6d693d cpe:2.3:a:dav-ee:dairy-management-system:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112088",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T16:46:37.530769Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:46:53.655Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:dav-ee:dairy-management-system:*:*:*:*:*:*:*:*"
],
"product": "dairy-management-system",
"vendor": "Dav-ee",
"versions": [
{
"status": "affected",
"version": "31ace9692d1e1e6d64339a42c463b361319c615c"
},
{
"status": "affected",
"version": "f31a584c3330c013b61f8b0306d9e0849c6d693d"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "7z2Z (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. This affects the function mysqli_query of the file farmers/add.php. Executing a manipulation of the argument f_no/f_id/f_name/f_locallity/f_ac/f_phone can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T06:30:16.024Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-421853 | Dav-ee dairy-management-system add.php mysqli_query sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/421853"
},
{
"name": "VDB-421853 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/421853/cti"
},
{
"name": "CVE-2026-112088 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-112088"
},
{
"name": "Submit #1011414 | Dav-ee dairy-management-system f31a584c3330c013b61f8b0306d9e0849c6d693d SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1011414"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/Dav-ee/dairy-management-system/issues/2"
},
{
"tags": [
"product"
],
"url": "https://github.com/Dav-ee/dairy-management-system/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-18T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-18T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-18T18:30:56.000Z",
"value": "VulDB entry last update"
}
],
"title": "Dav-ee dairy-management-system add.php mysqli_query sql injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-112088",
"datePublished": "2026-10-19T06:30:16.024Z",
"dateReserved": "2026-10-18T16:25:38.261Z",
"dateUpdated": "2026-10-19T16:46:53.655Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112091 (GCVE-0-2026-112091)
Vulnerability from cvelistv5 – Published: 2026-10-19 07:15 – Updated: 2026-10-19 07:15
VLAI
EPSS
VEX
Title
Dav-ee dairy-management-system AJAX Endpoint checkfarmer.json.php information disclosure
Summary
A flaw has been found in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. Impacted is an unknown function of the file delivery/checkfarmer.json.php of the component AJAX Endpoint. This manipulation of the argument fname causes information disclosure. Remote exploitation of the attack is possible. The exploit has been published and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/421856 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/421856/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-112091 | third-party-advisory |
| https://vuldb.com/submit/1011470 | third-party-advisory |
| https://github.com/Dav-ee/dairy-management-system… | exploitissue-tracking |
| https://github.com/Dav-ee/dairy-management-system/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Dav-ee | dairy-management-system |
Affected:
31ace9692d1e1e6d64339a42c463b361319c615c
Affected: f31a584c3330c013b61f8b0306d9e0849c6d693d cpe:2.3:a:dav-ee:dairy-management-system:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:dav-ee:dairy-management-system:*:*:*:*:*:*:*:*"
],
"modules": [
"AJAX Endpoint"
],
"product": "dairy-management-system",
"vendor": "Dav-ee",
"versions": [
{
"status": "affected",
"version": "31ace9692d1e1e6d64339a42c463b361319c615c"
},
{
"status": "affected",
"version": "f31a584c3330c013b61f8b0306d9e0849c6d693d"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Elymas (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. Impacted is an unknown function of the file delivery/checkfarmer.json.php of the component AJAX Endpoint. This manipulation of the argument fname causes information disclosure. Remote exploitation of the attack is possible. The exploit has been published and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Information Disclosure",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T07:15:15.643Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-421856 | Dav-ee dairy-management-system AJAX Endpoint checkfarmer.json.php information disclosure",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/421856"
},
{
"name": "VDB-421856 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/421856/cti"
},
{
"name": "CVE-2026-112091 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-112091"
},
{
"name": "Submit #1011470 | Dav-ee dairy-management-system f31a584c3330c013b61f8b0306d9e0849c6d693d Exposure of Private Personal Information to an Unauthorized Acto",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1011470"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/Dav-ee/dairy-management-system/issues/5"
},
{
"tags": [
"product"
],
"url": "https://github.com/Dav-ee/dairy-management-system/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-18T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-18T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-18T18:31:09.000Z",
"value": "VulDB entry last update"
}
],
"title": "Dav-ee dairy-management-system AJAX Endpoint checkfarmer.json.php information disclosure",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-112091",
"datePublished": "2026-10-19T07:15:15.643Z",
"dateReserved": "2026-10-18T16:25:49.328Z",
"dateUpdated": "2026-10-19T07:15:15.643Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112090 (GCVE-0-2026-112090)
Vulnerability from cvelistv5 – Published: 2026-10-19 07:00 – Updated: 2026-10-19 17:29
VLAI
EPSS
VEX
Title
Dav-ee dairy-management-system pay.php mysqli_real_escape_string sql injection
Summary
A vulnerability was detected in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. This issue affects the function mysqli_real_escape_string of the file payment/pay.php. The manipulation of the argument f_no/farmer results in sql injection. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 17:28 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/421855 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/421855/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-112090 | third-party-advisory |
| https://vuldb.com/submit/1011469 | third-party-advisory |
| https://github.com/Dav-ee/dairy-management-system… | exploitissue-tracking |
| https://github.com/Dav-ee/dairy-management-system/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Dav-ee | dairy-management-system |
Affected:
31ace9692d1e1e6d64339a42c463b361319c615c
Affected: f31a584c3330c013b61f8b0306d9e0849c6d693d cpe:2.3:a:dav-ee:dairy-management-system:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112090",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T17:28:41.487226Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T17:29:00.886Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:dav-ee:dairy-management-system:*:*:*:*:*:*:*:*"
],
"product": "dairy-management-system",
"vendor": "Dav-ee",
"versions": [
{
"status": "affected",
"version": "31ace9692d1e1e6d64339a42c463b361319c615c"
},
{
"status": "affected",
"version": "f31a584c3330c013b61f8b0306d9e0849c6d693d"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Elymas (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. This issue affects the function mysqli_real_escape_string of the file payment/pay.php. The manipulation of the argument f_no/farmer results in sql injection. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T07:00:11.646Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-421855 | Dav-ee dairy-management-system pay.php mysqli_real_escape_string sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/421855"
},
{
"name": "VDB-421855 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/421855/cti"
},
{
"name": "CVE-2026-112090 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-112090"
},
{
"name": "Submit #1011469 | Dav-ee dairy-management-system f31a584c3330c013b61f8b0306d9e0849c6d693d SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1011469"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/Dav-ee/dairy-management-system/issues/4"
},
{
"tags": [
"product"
],
"url": "https://github.com/Dav-ee/dairy-management-system/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-18T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-18T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-18T18:31:05.000Z",
"value": "VulDB entry last update"
}
],
"title": "Dav-ee dairy-management-system pay.php mysqli_real_escape_string sql injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-112090",
"datePublished": "2026-10-19T07:00:11.646Z",
"dateReserved": "2026-10-18T16:25:45.738Z",
"dateUpdated": "2026-10-19T17:29:00.886Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112089 (GCVE-0-2026-112089)
Vulnerability from cvelistv5 – Published: 2026-10-19 06:45 – Updated: 2026-10-19 16:36
VLAI
EPSS
VEX
Title
Dav-ee dairy-management-system delete.php mysqli_query sql injection
Summary
A security vulnerability has been detected in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. This vulnerability affects the function mysqli_query of the file employees/delete.php. The manipulation of the argument e_payroll_no leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 15:57 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/421854 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/421854/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-112089 | third-party-advisory |
| https://vuldb.com/submit/1011415 | third-party-advisory |
| https://github.com/Dav-ee/dairy-management-system… | exploitissue-tracking |
| https://github.com/Dav-ee/dairy-management-system/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Dav-ee | dairy-management-system |
Affected:
31ace9692d1e1e6d64339a42c463b361319c615c
Affected: f31a584c3330c013b61f8b0306d9e0849c6d693d cpe:2.3:a:dav-ee:dairy-management-system:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112089",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T15:57:56.449687Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:36:20.414Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:dav-ee:dairy-management-system:*:*:*:*:*:*:*:*"
],
"product": "dairy-management-system",
"vendor": "Dav-ee",
"versions": [
{
"status": "affected",
"version": "31ace9692d1e1e6d64339a42c463b361319c615c"
},
{
"status": "affected",
"version": "f31a584c3330c013b61f8b0306d9e0849c6d693d"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "7z2Z (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. This vulnerability affects the function mysqli_query of the file employees/delete.php. The manipulation of the argument e_payroll_no leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.8,
"vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T06:45:16.887Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-421854 | Dav-ee dairy-management-system delete.php mysqli_query sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/421854"
},
{
"name": "VDB-421854 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/421854/cti"
},
{
"name": "CVE-2026-112089 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-112089"
},
{
"name": "Submit #1011415 | Dav-ee dairy-management-system f31a584c3330c013b61f8b0306d9e0849c6d693d SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1011415"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/Dav-ee/dairy-management-system/issues/3"
},
{
"tags": [
"product"
],
"url": "https://github.com/Dav-ee/dairy-management-system/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-18T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-18T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-18T18:31:00.000Z",
"value": "VulDB entry last update"
}
],
"title": "Dav-ee dairy-management-system delete.php mysqli_query sql injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-112089",
"datePublished": "2026-10-19T06:45:16.887Z",
"dateReserved": "2026-10-18T16:25:42.191Z",
"dateUpdated": "2026-10-19T16:36:20.414Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112088 (GCVE-0-2026-112088)
Vulnerability from cvelistv5 – Published: 2026-10-19 06:30 – Updated: 2026-10-19 16:46
VLAI
EPSS
VEX
Title
Dav-ee dairy-management-system add.php mysqli_query sql injection
Summary
A weakness has been identified in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. This affects the function mysqli_query of the file farmers/add.php. Executing a manipulation of the argument f_no/f_id/f_name/f_locallity/f_ac/f_phone can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 16:46 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/421853 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/421853/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-112088 | third-party-advisory |
| https://vuldb.com/submit/1011414 | third-party-advisory |
| https://github.com/Dav-ee/dairy-management-system… | exploitissue-tracking |
| https://github.com/Dav-ee/dairy-management-system/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Dav-ee | dairy-management-system |
Affected:
31ace9692d1e1e6d64339a42c463b361319c615c
Affected: f31a584c3330c013b61f8b0306d9e0849c6d693d cpe:2.3:a:dav-ee:dairy-management-system:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112088",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T16:46:37.530769Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:46:53.655Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:dav-ee:dairy-management-system:*:*:*:*:*:*:*:*"
],
"product": "dairy-management-system",
"vendor": "Dav-ee",
"versions": [
{
"status": "affected",
"version": "31ace9692d1e1e6d64339a42c463b361319c615c"
},
{
"status": "affected",
"version": "f31a584c3330c013b61f8b0306d9e0849c6d693d"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "7z2Z (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. This affects the function mysqli_query of the file farmers/add.php. Executing a manipulation of the argument f_no/f_id/f_name/f_locallity/f_ac/f_phone can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T06:30:16.024Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-421853 | Dav-ee dairy-management-system add.php mysqli_query sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/421853"
},
{
"name": "VDB-421853 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/421853/cti"
},
{
"name": "CVE-2026-112088 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-112088"
},
{
"name": "Submit #1011414 | Dav-ee dairy-management-system f31a584c3330c013b61f8b0306d9e0849c6d693d SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1011414"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/Dav-ee/dairy-management-system/issues/2"
},
{
"tags": [
"product"
],
"url": "https://github.com/Dav-ee/dairy-management-system/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-18T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-18T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-18T18:30:56.000Z",
"value": "VulDB entry last update"
}
],
"title": "Dav-ee dairy-management-system add.php mysqli_query sql injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-112088",
"datePublished": "2026-10-19T06:30:16.024Z",
"dateReserved": "2026-10-18T16:25:38.261Z",
"dateUpdated": "2026-10-19T16:46:53.655Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}