SQL Injection Vulnerability in Dav-ee Dairy Management System
CVE-2026-112089

5.1MEDIUM

Key Information:

Vendor

Dav-ee

Status
Dairy-management-system
Vendor
CVE Published:
19 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-112089?

A critical vulnerability has been identified in the Dav-ee dairy-management-system, specifically within the mysqli_query function found in employees/delete.php. This issue arises from improper handling of the e_payroll_no parameter, allowing for SQL injection attacks that can be performed remotely. As this exploit is now publicly known, it poses a significant threat to users of the affected system. Although the project has been informed through early issue reports, appropriate responses have yet to be issued. The system follows a rolling release model for continuous updates, which complicates identifying specific impacted versions.

Affected Version(s)

dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c

dairy-management-system f31a584c3330c013b61f8b0306d9e0849c6d693d

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-112089 - Proof of Concept

References

https://vuldb.com/vuln/421854
vdb-entrytechnical-description
https://vuldb.com/vuln/421854/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-112089
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

7z2Z (VulDB User)
VulDB CNA Team
.