CVE-2026-112089: SQL Injection in Dav-ee dairy-management-system

This vulnerability in Dav-ee dairy-management-system involves SQL injection in the employees/delete.php file, specifically in the mysqli_query function when processing the e_payroll_no argument. An attacker can remotely manipulate this parameter to execute arbitrary SQL commands. The product's rolling release model prevents precise version identification of affected releases. The issue was reported early to the project, but no vendor response or patch is currently available. The CVSS 4.0 base score is 5.1, indicating medium severity with network attack vector, low complexity, and no user interaction required.

Successful exploitation could allow an attacker with high privileges to execute arbitrary SQL commands remotely, potentially leading to unauthorized data access or modification. The vulnerability has a medium severity score (CVSS 5.1), reflecting limited impact due to required privileges and low vector complexity. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should monitor for official updates. In the meantime, restricting access to the affected functionality and validating or sanitizing inputs to the e_payroll_no parameter may reduce risk.