Live › vulnerability › CVE-2026-112089
Go to dashboardThe Dav-ee dairy-management-system has an SQL injection flaw in employees/delete.php, where the e_payroll_no argument is passed unsafely to mysqli_query. A remote attacker can alter database queries to read or change stored data, and a public exploit has been disclosed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any installation of the Dav-ee dairy-management-system running the affected commit that exposes employees/delete.php to the network is potentially exposed. The sources do not say which configurations or roles are required, and the product has no versioned releases to compare against.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security vulnerability has been detected in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. This vulnerability affects the function mysqli_query of the file employees/delete.php. The manipulation of the argument e_payroll_no leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-112089")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.