Dairy Management System EUVD-2026-104092

Exploitation requires an authenticated low-privileged session (CVSS PR:L) that can reach the farmers/add.php page, and the attacker must supply malicious input in at least one of the named parameters - f_no, f_id, f_name, f_locallity, f_ac, or f_phone - which is passed unsanitized into mysqli_query. The limiting factors are the authentication requirement (not remotely unauthenticated) and the niche deployment of the product; no special non-default configuration is described, so any instance exposing this add-farmer form to an authenticated user is affected. No user interaction by a victim is needed (UI:N).

Real-world risk is LOW despite a public exploit. The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity SQL injection that nonetheless requires PR:L - i.e. an authenticated low-privileged account - and the vendor-assigned base score is only 2.1 with uniformly Low impacts (VC:L/VI:L/VA:L). This is the characteristic profile of a VulDB-sourced disclosure against a small open-source GitHub project: publicly available exploit code exists (E:P in the vector and an 'exploit' reference to a GitHub issue), but there is no CISA KEV listing and no EPSS score supplied, so there is no evidence of widespread or automated exploitation. The POC availability and active-exploitation signals must not be conflated - a published PoC proves the bug is trivially reproducible, not that it is being used in the wild. The main signals are internally consistent (low score, limited impact, authentication required, niche product), so this is a genuine-but-low-priority issue for the small population actually running this application, not a high-CVSS/low-real-risk mismatch. Missing data to note explicitly: no EPSS value, no KEV entry, and no affected-version data because the vendor does not use versioning.

An attacker who already holds a low-privileged authenticated session browses to the farmers/add.php endpoint and submits a crafted value in one of the f_no/f_id/f_name/f_locallity/f_ac/f_phone fields that breaks out of the mysqli_query SQL statement. Because a public exploit for this injection point has been published (GitHub issue), the attacker can reliably extract or tamper with limited database contents. Exploitation is remote and low-complexity but gated behind having a valid account.