Information Disclosure Vulnerability in Dav-ee Dairy Management System's AJAX Endpoint
CVE-2026-112091

6.9MEDIUM

Key Information:

Vendor

Dav-ee

Status
Dairy-management-system
Vendor
CVE Published:
19 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-112091?

A security flaw in the Dav-ee dairy-management-system has been detected, specifically within the AJAX Endpoint component. An improper manipulation of the 'fname' argument in the delivery/checkfarmer.json.php file raises concerns about potential information disclosure, allowing unauthorized access to sensitive data. This vulnerability enables remote exploitation, posing a significant risk to the data integrity of affected systems. Despite early notification regarding this issue, the project has not provided a timely response or updates.

Affected Version(s)

dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c

dairy-management-system f31a584c3330c013b61f8b0306d9e0849c6d693d

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-112091 - Proof of Concept

References

https://vuldb.com/vuln/421856
vdb-entrytechnical-description
https://vuldb.com/vuln/421856/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-112091
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Elymas (VulDB User)
VulDB CNA Team
.