CVE-2026-112088: SQL Injection in Dav-ee dairy-management-system

This vulnerability in Dav-ee dairy-management-system involves improper sanitization of input parameters (f_no, f_id, f_name, f_locallity, f_ac, f_phone) passed to the mysqli_query function in the farmers/add.php file. An attacker can remotely exploit this flaw by manipulating these arguments to perform SQL injection attacks. The product does not use versioning, so specific affected versions cannot be determined. The vendor was notified early, but no patch or fix information is available. Public exploit code exists, increasing the risk of exploitation.

Successful exploitation allows remote attackers to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access, modification, or deletion. The CVSS 4.0 score of 5.3 reflects a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability could compromise data integrity and confidentiality within the dairy-management-system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing input validation and parameterized queries as temporary mitigations. Monitor vendor channels for updates and apply patches promptly once available.