Is CVE-2026-112090 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-112090 being exploited in the wild.

How severe is CVE-2026-112090?

Medium severity, with a CVSS score of 6.3, published 19 October 2026.

Is there a fix for CVE-2026-112090?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-112090 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-112090?

Check whether you run Dav-ee Dairy-Management-System. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112090: Dav-ee dairy-management-system SQL injection in payment module

CVE-2026-112090 · Severity: medium · CVSS 6.3 · Published 2026-10-19

A dairy management system used to track milk delivery to farms contains a SQL injection vulnerability in its payment processing module. An authenticated user, such as a clerk, can inject malicious SQL commands to read or manipulate sensitive data including farmer information and delivery records. Since the database runs with root privileges, an attacker could potentially compromise the entire database.

Technologies: Dav-ee Dairy-Management-System. Vendors: Dav-ee.

Quick answers

Is CVE-2026-112090 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-112090 being exploited in the wild.
How severe is CVE-2026-112090?: Medium severity, with a CVSS score of 6.3, published 19 October 2026.
Which products and versions are affected?: Dav-ee dairy-management-system.
Is there a fix for CVE-2026-112090?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-112090 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-112090?: Check whether you run Dav-ee Dairy-Management-System. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

SQL injection in payment/pay.php and reports/farmer_monthly.php arises from using mysqli_real_escape_string() on user-supplied input (f_no/farmer parameters) before inserting it into unquoted SQL contexts. This escaping function only neutralizes quote characters but leaves spaces, operators (OR, AND), and parentheses intact, allowing attackers to inject boolean logic and time-based payloads. The vulnerability requires authentication but allows any authenticated user to execute arbitrary queries against the database.

Affected products

Dav-ee dairy-management-system

Timeline

2026-10-19: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.