CVE-2026-112091
Received Received - Intake

Information Disclosure in Dav-ee Dairy-Management-System via AJAX Endpoint

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulDB

Description
A flaw has been found in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. Impacted is an unknown function of the file delivery/checkfarmer.json.php of the component AJAX Endpoint. This manipulation of the argument fname causes information disclosure. Remote exploitation of the attack is possible. The exploit has been published and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112091
EUVD
EUVD-2026-104109

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c
Dav-ee dairy-management-system f31a584c3330c013b61f8b0306d9e0849c6d693d

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an information disclosure flaw in the Dav-ee dairy-management-system. The file delivery/checkfarmer.json.php allows unauthenticated access to sensitive farmer data by manipulating the fname argument. The system fails to enforce authentication checks, exposing personal and financial details like names, localities, bank account numbers, and phone numbers through a simple POST request.

Detection Guidance

Check if the file delivery/checkfarmer.json.php is accessible without authentication by sending a POST request with a farmer number parameter. Example using curl: curl -X POST http://<target>/delivery/checkfarmer.json.php -d 'fname=<farmer_number>'

Monitor network traffic for unauthorized access attempts to the delivery/checkfarmer.json.php endpoint, especially POST requests with farmer number parameters.

Impact Analysis

Attackers can remotely exploit this to steal sensitive farmer data without authentication. This includes personal identifiers and financial information, leading to identity theft, fraud, or privacy violations. The exploit is publicly available, increasing the risk of widespread misuse.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal data and HIPAA if financial or health-related farmer data is exposed. It breaches data protection principles requiring strict access controls and user authentication.

Mitigation Strategies

Remove or restrict access to the delivery/checkfarmer.json.php file immediately. Implement proper authentication checks in the script to ensure only authorized users can access sensitive data.

Update the system to enforce authentication via incl/header.incl.php for all sensitive endpoints, including delivery/checkfarmer.json.php.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112091. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart