Which versions of PHP are affected by CVE-2026-4580?

A critical SQL injection vulnerability in Simple Laundry System v1.0 allows unauthenticated attackers to execute arbitrary database commands, with publicly available exploit code already circulating.

Is there a public PoC exploit available for CVE-2026-4580?

Yes, a public proof-of-concept exploit is available for CVE-2026-4580. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4580?

Within 24 hours: Inventory all systems running Simple Laundry System v1.0 and immediately isolate affected instances from production networks or disable the application. Within 7 days: Deploy Web Application Firewall (WAF) rules to block SQL injection patterns targeting /checkupdatestatus.php and restrict network access to this application to trusted internal networks only. Within 30 days: Migrate to an alternative laundry management solution or await vendor security patch; conduct full database audit for unauthorized access or data exfiltration.

PHP CVE-2026-4580

Q: What is the CVSS score of CVE-2026-4580?

CVE-2026-4580 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-14390 MEDIUM

SQL Injection (CWE-89)

2026-03-23 VulDB

GHSA-r3f3-v663-2fq7

PHP SQLi Simple Laundry System Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 03, 2026 - 17:48 vuln.today

Public exploit code

EUVD ID Assigned

Mar 23, 2026 - 09:00 euvd

EUVD-2026-14390

Analysis Generated

Mar 23, 2026 - 09:00 vuln.today

CVE Published

Mar 23, 2026 - 08:48 nvd

MEDIUM 6.9

DescriptionCVE.org

A security flaw has been discovered in code-projects Simple Laundry System 1.0. This impacts an unknown function of the file /checkupdatestatus.php of the component Parameters Handler. The manipulation of the argument serviceId results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

SQL injection in Simple Laundry System 1.0's /checkupdatestatus.php parameter handler allows unauthenticated remote attackers to manipulate the serviceId argument and execute arbitrary SQL queries. Public exploit code exists for this vulnerability, and no patch is currently available, creating immediate risk for affected deployments.

Technical ContextAI

This vulnerability affects code-projects Simple Laundry System version 1.0 (CPE: cpe:2.3:a:code-projects:simple_laundry_system:*:*:*:*:*:*:*:*), a PHP-based web application for managing laundry service operations. The issue is classified as CWE-89 (SQL Injection), occurring in the Parameters Handler component that processes the checkupdatestatus.php endpoint. The serviceId parameter lacks proper input sanitization and parameterized query implementation, allowing attackers to inject malicious SQL statements directly into database queries. This is a classic example of improper neutralization of special elements used in SQL commands, where user-controlled input is concatenated into SQL queries without validation or escaping.

RemediationAI

No official patch or updated version from code-projects appears to be available based on the provided references (Remediation Level: X indicates unavailable). Organizations should immediately discontinue use of Simple Laundry System 1.0 in production environments or isolate it from internet access. Implement a web application firewall (WAF) with SQL injection detection rules to filter malicious requests to /checkupdatestatus.php, specifically sanitizing the serviceId parameter. Apply input validation using allowlists that restrict serviceId to expected numeric values only, and migrate database queries to use parameterized statements or prepared statements in PHP. Network-level controls should restrict access to the application to trusted IP ranges only. Consider migrating to alternative, actively maintained laundry management software with security support.