EUVD-2025-17300Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to system
-
DeliveryNavigate to /data/insert_laundry.php
-
ExploitInject XSS payload in Customer parameter
-
ExecutionVictim views laundry record
-
PersistScript executes in victim's browser
-
ImpactImpact: session theft or UI manipulation
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A03:2021 - Injection
ASVS 5.0
V5 - Validation, Sanitization and Encoding Input validation, output encoding, parameterized queries
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires authenticated access to the laundry system (PR:L) and user interaction (UI:P) from a victim viewing the injected data. The attack is remote over the network (AV:N). No special configuration needed beyond default installation. |
| Impact | CVSS 4.0 base score is 2.0 (Low) with vector AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N, indicating low impact and requiring low privileges and user interaction. EPSS score is 0.05% (16th percentile), suggesting low exploitation likelihood. No KEV listing. Public exploit exists but no active exploitation confirmed. Overall risk is low. |
| Exploit ScenarioDerived | An attacker with low-privileged access to the laundry system submits a malicious script in the Customer field. When an administrator views the laundry record, the script executes, potentially stealing session cookies or performing actions on behalf of the admin. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 26, 2026
Cross-site scripting (XSS) in code-projects Laundry System 1.0 allows an authenticated attacker to inject arbitrary JavaScript via the Customer parameter in /data/insert_laundry.php. A public exploit exists, but no active exploitation has been reported; EPSS score is low (0.05%).
Earlier versions of this analysis (1)
RemediationAI
No official patch has been released by the vendor. As a workaround, sanitize the Customer input parameter in /data/insert_laundry.php by escaping HTML entities or implementing a whitelist. Alternatively, disable the affected functionality if not needed. Monitor for updates from code-projects.org.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a stored XSS (CWE-79) in a PHP-based laundry management system. The affected file /data/insert_laundry.php processes user input for the Customer field without proper sanitization, allowing script injection. The CPE indicates the product is 'simple_laundry_system' version 1.0 from code-projects.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Requires low privileges and user interaction; low CIA impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was found in code-projects Laundry System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /data/insert_laundry.php. The manipulation of the argument Customer leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Executive ViewAI
CVE-2025-5764 is a low-severity vulnerability in A vulnerability involving cross-site scripting (CVSS 3.5). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation. Apply vendor updates when available as part of routine maintenance.
Apply vendor patch during routine maintenance. Standard cross-site scripting mitigations apply if patching is delayed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB