CVE-2026-112091: Information Disclosure in Dav-ee dairy-management-system

This vulnerability in Dav-ee dairy-management-system arises from improper handling of the 'fname' parameter in the AJAX endpoint delivery/checkfarmer.json.php. An attacker can manipulate this argument to disclose sensitive information remotely. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity impact. The product's rolling release approach means no discrete version numbers are available to identify affected or patched releases. Although the issue was reported early, the vendor has not yet provided a response or remediation.

Successful exploitation allows remote attackers to disclose sensitive information from the system without authentication or user interaction. This could lead to exposure of confidential data managed by the dairy-management-system. There is no indication of privilege escalation, denial of service, or code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should monitor official channels for updates. In the meantime, restricting access to the affected AJAX endpoint and validating input parameters may reduce exposure.