Dairy Management System CVE-2026-112091

No special conditions beyond network reachability - the flaw is a remote, unauthenticated manipulation of the fname argument to the delivery/checkfarmer.json.php AJAX endpoint of the Dav-ee dairy-management-system, exploitable against a running instance without credentials or user interaction (AV:N/AC:L/AT:N/PR:N/UI:N). The practical limiting factors are that the target instance must be network-reachable (e.g., internet-exposed), the specific exploitable endpoint/parameter must be deployed, and the product's extremely small deployment base sharply narrows the realistic target set; impact is confined to information disclosure with no integrity or availability effect.

This is a medium-severity information disclosure flaw (CVSS 4.0 base 6.9) in the Dav-ee dairy-management-system, an open-source PHP application. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated attack requiring no user interaction - favorable conditions for exploitation - but impact is limited to low confidentiality (VC:L) with no integrity or availability effect, which is why the score lands in the medium range rather than critical. The vector carries E:P (Proof-of-Concept), consistent with the reported publicly available exploit; this means publicly available exploit code exists but NOT confirmed active exploitation. The CVE is not listed in CISA KEV, and no EPSS score was provided in the input, so real-world exploitation frequency cannot be quantified from the data at hand. The dominant mitigating factor is prevalence: this is an obscure hobby/open-source project with negligible enterprise footprint, so despite the easy exploit profile, the practical risk to most organizations is low. One caveat: the vendor was notified via an issue report but has not responded, and the rolling-release model means no patched version is identified - so there is no vendor-confirmed fix to deploy.

A remote, unauthenticated attacker sends a crafted request to the delivery/checkfarmer.json.php AJAX endpoint, manipulating the fname parameter to coax the application into returning information it should not disclose. A public proof-of-concept exists (linked to the project's GitHub issue tracker), lowering the skill barrier. Because no authentication or user interaction is required, the request can be issued directly against any internet-exposed instance.