Which versions of PHP are affected by CVE-2026-4581?

A critical SQL injection vulnerability in Simple Laundry System 1.0 allows unauthenticated attackers to directly access and manipulate the application database without authorization.

Is there a public PoC exploit available for CVE-2026-4581?

Yes, a public proof-of-concept exploit is available for CVE-2026-4581. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4581?

Within 24 hours: Inventory all systems running Simple Laundry System 1.0 and assess business criticality; isolate affected systems from production networks if possible. Within 7 days: Implement Web Application Firewall (WAF) rules to block SQL injection patterns targeting /checklogin.php; enable comprehensive logging and monitoring for suspicious authentication attempts; restrict network access to the application to authorized users only. Within 30 days: Evaluate migration to patched or alternative laundry management solutions; conduct forensic analysis for evidence of compromise; if remaining on vulnerable version, establish continuous vulnerability scanning and threat monitoring protocols.

PHP CVE-2026-4581

Q: What is the CVSS score of CVE-2026-4581?

CVE-2026-4581 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-14392 MEDIUM

SQL Injection (CWE-89)

2026-03-23 VulDB

GHSA-24g2-fgx6-x4g7

PHP SQLi Simple Laundry System Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 03, 2026 - 17:47 vuln.today

Public exploit code

EUVD ID Assigned

Mar 23, 2026 - 09:45 euvd

EUVD-2026-14392

Analysis Generated

Mar 23, 2026 - 09:45 vuln.today

CVE Published

Mar 23, 2026 - 09:33 nvd

MEDIUM 6.9

DescriptionCVE.org

A weakness has been identified in code-projects Simple Laundry System 1.0. Affected is an unknown function of the file /checklogin.php of the component Parameters Handler. This manipulation of the argument Username causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. If you want to get best quality of vulnerability data, you may have to visit VulDB.

AnalysisAI

SQL injection in Simple Laundry System 1.0's /checklogin.php parameter handler allows unauthenticated remote attackers to manipulate the Username field and execute arbitrary database queries. Public exploit code exists for this vulnerability, increasing the risk of active exploitation. No patch is currently available, leaving affected PHP installations vulnerable to data theft and unauthorized access.

Technical ContextAI

This vulnerability affects code-projects Simple Laundry System version 1.0 (CPE: cpe:2.3:a:code-projects:simple_laundry_system:*:*:*:*:*:*:*:*), a PHP-based web application for managing laundry services. The root cause is CWE-89 (SQL Injection), where user-supplied input from the Username parameter in the checklogin.php authentication handler is incorporated into SQL queries without proper validation or parameterization. This classic input validation failure allows attackers to break out of the intended SQL query structure and execute arbitrary SQL commands against the backend database, potentially bypassing authentication, extracting sensitive data, modifying records, or executing administrative operations on the database server.

RemediationAI

No official patch or updated version has been released by code-projects as of this analysis (remediation level is unavailable per CVSS vector RL:X). Organizations currently running Simple Laundry System 1.0 should implement immediate compensatory controls including deploying a web application firewall (WAF) with SQL injection detection rules, restricting network access to the application to trusted IP ranges only, and implementing strict input validation at the network perimeter. Consider migrating to an alternative, actively maintained laundry management system with proper security support. Until migration is complete, monitor database logs for suspicious query patterns and unauthorized access attempts. Detailed vulnerability information is available from VulDB at https://vuldb.com/?id.352418 and the public exploit can be reviewed at https://github.com/anon387tdug/anon388/issues/1 to understand specific attack patterns for detection rules.