Is CVE-2026-112088 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-112088 being exploited in the wild.

How severe is CVE-2026-112088?

Medium severity, with a CVSS score of 6.3, published 19 October 2026.

Which products and versions are affected?

Dav-ee Dairy-Management-System commit f31a584c3330c013b61f8b0306d9e0849c6d693d (product does not use versioning).

Is there a fix for CVE-2026-112088?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-112088 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-112088?

Check whether you run Dav-ee Dairy-Management-System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112088: Dav-ee dairy-management-system SQL injection in farmers module

CVE-2026-112088 · Severity: medium · CVSS 6.3 · Published 2026-10-19

Dav-ee's dairy management system, a web application for tracking milk deliveries to farms, contains SQL injection vulnerabilities in its farmer record handling. An authenticated user with even the lowest privilege level can inject malicious SQL through farmer fields to read, modify, or delete arbitrary database records. This could expose sensitive farm and payment data or allow an attacker to corrupt the entire system.

Technologies: Dav-ee Dairy-Management-System. Vendors: Dav-ee.

Quick answers

Is CVE-2026-112088 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-112088 being exploited in the wild.
How severe is CVE-2026-112088?: Medium severity, with a CVSS score of 6.3, published 19 October 2026.
Which products and versions are affected?: Dav-ee Dairy-Management-System commit f31a584c3330c013b61f8b0306d9e0849c6d693d (product does not use versioning).
Is there a fix for CVE-2026-112088?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-112088 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-112088?: Check whether you run Dav-ee Dairy-Management-System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

SQL injection exists in farmers/add.php, farmers/edit.php, and farmers/validate.php where POST parameters (f_no, f_id, f_name, f_locallity, f_ac, f_phone) are concatenated directly into INSERT, UPDATE, and SELECT queries without escaping or parameterization. Any authenticated user, including the lowest-privilege Clerk role, can trigger the vulnerability remotely by submitting a crafted farmer record. An attacker gains unrestricted read and write access to the application database.

Affected products

Dav-ee dairy-management-system commit f31a584c3330c013b61f8b0306d9e0849c6d693d (product does not use versioning)

Timeline

2026-10-19: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.