Description
A weakness has been identified in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. This affects the function mysqli_query of the file farmers/add.php. Executing a manipulation of the argument f_no/f_id/f_name/f_locallity/f_ac/f_phone can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure.
Published: 2026-10-19
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote SQL Injection
Action: Patch
AI Analysis

Impact

An unverified input handling flaw within the dairy-management-system allows the construction of arbitrary SQL statements when passing certain fields to the mysqli_query function. By injecting crafted SQL via the f_no, f_id, f_name, f_locallity, f_ac, or f_phone parameters an attacker could alter database queries, potentially exposing or tampering with stored data.

Affected Systems

The affected product is the dairy-management-system provided by Dav-ee. The flaw exists in the add.php script that utilizes mysqli_query. Version information is unavailable because the product does not employ a standard versioning scheme; therefore, all releases are potentially impacted.

Risk and Exploitability

The CVSS score of 5.3 signals a moderate threat level. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalogue. The publicly available exploit demonstrates that the flaw can be triggered remotely. Attackers could exploit the vulnerability if the system remains unpatched, making it an actionable risk for any environment running the software.

Generated by OpenCVE AI on October 19, 2026 at 08:27 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest vendor update or patch that addresses the SQL injection in add.php.
  • Refactor the code to use prepared statements or an ORM to eliminate raw SQL construction.
  • Validate and sanitize all user inputs (f_no, f_id, f_name, f_locallity, f_ac, f_phone) before they reach the database layer.

Generated by OpenCVE AI on October 19, 2026 at 08:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 07:00:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. This affects the function mysqli_query of the file farmers/add.php. Executing a manipulation of the argument f_no/f_id/f_name/f_locallity/f_ac/f_phone can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure.
Title Dav-ee dairy-management-system add.php mysqli_query sql injection
First Time appeared Dav-ee
Dav-ee dairy-management-system
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:dav-ee:dairy-management-system:*:*:*:*:*:*:*:*
Vendors & Products Dav-ee
Dav-ee dairy-management-system
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Dav-ee Dairy-management-system
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-19T06:30:16.024Z

Reserved: 2026-10-18T16:25:38.261Z

Link: CVE-2026-112088

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-19T07:16:30.873

Modified: 2026-10-19T07:16:30.873

Link: CVE-2026-112088

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T08:30:13Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')