CVE-2026-112091: Dav-ee dairy-management-system AJAX Endpoint checkfarmer.json.php information disclosure
A flaw has been found in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. Impacted is an unknown function of the file delivery/checkfarmer.json.php of the component AJAX Endpoint. This manipulation of the argument fname causes information disclosure. Remote exploitation of the attack is possible. The exploit has been published and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
The endpoint is remotely exploitable and requires no privileges or user interaction. Any deployment where the affected delivery/checkfarmer.json.php AJAX endpoint is reachable over the network may be exposed.
What does an attacker need to do?
An attacker manipulates the fname argument sent to delivery/checkfarmer.json.php. The resulting impact is information disclosure.
Is public exploit information available?
Yes. An exploit has been published, which increases the likelihood of attempted exploitation.
How can affected deployments be identified when versions are not available?
Version-based assessment is not possible because the project uses a rolling-release model and affected or fixed release details were not provided. Review deployments for the delivery/checkfarmer.json.php endpoint and test or inspect how it handles the fname argument.
Is a vendor fix or response available?
The project was notified through an issue report but had not responded at the time of publication. No updated release or workaround is provided in the available information.