EUVD-2025-17352Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to admin panel
-
DeliverySend crafted POST to /data/edit_type.php with XSS payload
-
ExploitPayload stored in database
-
ExecutionVictim admin views page
-
PersistScript executes in victim's browser
-
ImpactSteal session or perform actions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A03:2021 - Injection
ASVS 5.0
V5 - Validation, Sanitization and Encoding Input validation, output encoding, parameterized queries
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must be authenticated (PR:L) and the victim must click on or interact with the injected content (UI:P). The attack is remote over the network (AV:N) with low complexity (AC:L). No special configuration is required beyond default installation. |
| Impact | CVSS 4.0 base score is 2.0 (Low) with vector AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N, indicating low impact on integrity only, with user interaction required. EPSS score is 0.05% (16th percentile), suggesting very low exploitation probability. A public exploit exists but no KEV listing or active exploitation confirmed. The risk is low due to required authentication and user interaction, and limited impact. |
| Exploit ScenarioDerived | An authenticated attacker with access to the laundry system's admin panel sends a crafted request to /data/edit_type.php with a malicious script in the 'Type' parameter. When another admin views the affected page, the script executes, potentially stealing session cookies or performing actions on behalf of the victim. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 26, 2026
Cross-site scripting (XSS) in code-projects Laundry System 1.0 allows remote authenticated users to inject arbitrary web scripts via the 'Type' parameter in /data/edit_type.php. A public exploit exists, but no active exploitation has been reported; EPSS score is low (0.05%).
Earlier versions of this analysis (1)
RemediationAI
No vendor-released patch identified at time of analysis. As a workaround, sanitize the 'Type' parameter in /data/edit_type.php by escaping HTML special characters or implementing a whitelist of allowed values. Alternatively, restrict access to the edit_type.php endpoint to trusted administrators only. Note that these mitigations may break functionality if the Type field expects arbitrary input.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a stored cross-site scripting (XSS) issue in a PHP-based laundry management system. The affected file /data/edit_type.php processes user input for the 'Type' argument without proper sanitization, allowing injection of malicious scripts. CWE-79 describes the root cause as improper neutralization of input during web page generation. The CPE indicates the product is 'simple_laundry_system' version 1.0 from code-projects.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Requires authentication and user interaction; low integrity impact only.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability has been found in code-projects Laundry System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /data/edit_type.php. The manipulation of the argument Type leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Executive ViewAI
CVE-2025-5796 is a low-severity vulnerability in A vulnerability involving cross-site scripting (CVSS 3.5). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation. Apply vendor updates when available as part of routine maintenance.
Apply vendor patch during routine maintenance. Standard cross-site scripting mitigations apply if patching is delayed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB