Live › vulnerability › CVE-2026-112088
Go to dashboardThe farmers/add.php page of the Dav-ee dairy management system passes form fields such as f_no, f_id, f_name and f_phone into a mysqli_query call without safe parameter binding. A remote attacker can alter the database queries to read or change stored farmer and dairy records.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any deployment of the Dav-ee dairy-management-system that exposes farmers/add.php to a network is exposed, since the flaw is reachable remotely through the form parameters. The sources do not give a fixed version, and the product does not use version numbers, so the affected range is unknown. Teams that do not run this code, or that keep the admin area off the internet, can skip it.
No product ranges from the sources yet.
farmers/add.php in the project and check whether the mysqli_query call builds SQL from $_POST or $_GET values without prepared statements31ace9692d1e1e6d64339a42c463b361319c615c and f31a584c3330c013b61f8b0306d9e0849c6d693dUnknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A weakness has been identified in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. This affects the function mysqli_query of the file farmers/add.php. Executing a manipulation of the argument f_no/f_id/f_name/f_locallity/f_ac/f_phone can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure.
This page as .md · .json · in your agent: get_signal("CVE-2026-112088")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.