EUVD-2026-14388
GHSA-xr35-94xw-8gm8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was identified in code-projects Simple Laundry System 1.0. This affects an unknown function of the file /viewdetail.php of the component Parameters Handler. The manipulation of the argument serviceId leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
AnalysisAI
SQL injection in Simple Laundry System 1.0 through the serviceId parameter in /viewdetail.php allows unauthenticated remote attackers to execute arbitrary SQL queries. Public exploit code exists for this vulnerability, and no patch is currently available. Attackers can exploit this to read or modify sensitive database information.
Technical ContextAI
This vulnerability affects code-projects Simple Laundry System version 1.0 (CPE: cpe:2.3:a:code-projects:simple_laundry_system:*:*:*:*:*:*:*:*), a PHP-based application for managing laundry services. The root cause is CWE-89 (SQL Injection), where the Parameters Handler in viewdetail.php fails to properly sanitize the serviceId parameter before incorporating it into SQL queries. This allows attackers to inject malicious SQL commands that are executed by the backend database, bypassing application logic and security controls. The vulnerability stems from inadequate input validation and lack of parameterized queries or prepared statements in the PHP codebase.
RemediationAI
No official patch or updated version from code-projects has been identified in available references (RL:X indicates unavailable remediation level). Organizations should immediately remove Simple Laundry System 1.0 from production environments or isolate it from network access until a fix is available. As interim mitigations, implement web application firewall (WAF) rules to detect and block SQL injection attempts targeting the serviceId parameter in /viewdetail.php, restrict access to the application to trusted IP ranges only, and deploy database-level access controls with least privilege principles. Review application logs for suspicious serviceId parameter values that may indicate exploitation attempts. Consider replacing this application with a maintained alternative that receives regular security updates.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today