The vulnerability arises from improper handling of the fname argument in the AJAX endpoint checkfarmer.json.php. Manipulating this argument leads to disclosure of sensitive information. The flaw permits remote exploitation, allowing an attacker to retrieve unauthorized data through web-based requests.

The affected product is the Dav-ee dairy-management-system, specifically the delivery/checkfarmer.json.php component of its AJAX interface. No specific release or commit is identified, and the vendor follows a rolling release model, so affected versions cannot be enumerated.

The CVSS base score of 6.9 indicates a medium severity. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Based on the description and the remote nature of the exploit, the likely attack vector is a web application or network-based request. An attacker who can send crafted HTTP requests to the endpoint could obtain information without authentication, assuming no additional access controls are enforced.