What is the CVSS score of CVE-2026-4581?

CVE-2026-4581 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-4581?

Yes, a public proof-of-concept exploit is available for CVE-2026-4581. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4581?

Within 24 hours: Inventory all systems running Simple Laundry System 1.0 and assess business criticality; isolate affected systems from production networks if possible. Within 7 days: Implement Web Application Firewall (WAF) rules to block SQL injection patterns targeting /checklogin.php; enable comprehensive logging and monitoring for suspicious authentication attempts; restrict network access to the application to authorized users only. Within 30 days: Evaluate migration to patched or alternative laundry management solutions; conduct forensic analysis for evidence of compromise; if remaining on vulnerable version, establish continuous vulnerability scanning and threat monitoring protocols.

Simple Laundry System CVE-2026-4581

EUVD-2026-14392 MEDIUM

SQL Injection (CWE-89)

2026-03-23 VulDB

GHSA-24g2-fgx6-x4g7

PHP SQLi Simple Laundry System Code Projects

5.5

CVSS 4.0 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-89 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Parameterized queries, prepared statements MITRE ATT&CK 2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	The CVSS v3.1 base score of 7.3 (High) reflects the serious nature of this vulnerability with metrics indicating network-based attack vector (AV:N), low complexity (AC:L), no privileges required (PR:N), and no user interaction needed (UI:N). The temporal score modifiers show proof-of-concept exploit code exists (E:P) and remediation level is unavailable (RL:X). The publicly available exploit on GitHub dramatically increases real-world risk, as attackers can immediately weaponize this vulnerability without developing custom exploits. Authentication bypass combined with SQL injection in a small open-source project with unclear vendor support creates a high-priority risk for organizations using this system. The lack of patch information (RL:X) suggests no official fix is available, making this an urgent concern for current users who have limited mitigation options beyond complete product replacement.
Exploit ScenarioDerived	An unauthenticated attacker identifies a publicly accessible Simple Laundry System installation and navigates to the login page. Using the publicly available GitHub proof-of-concept exploit, the attacker crafts a malicious HTTP request to /checklogin.php with a SQL injection payload in the Username parameter (for example: admin' OR '1'='1' -- ) to bypass authentication controls. Upon successful exploitation with low attack complexity and no user interaction required, the attacker gains unauthorized administrative access to the system, allowing them to extract customer records, financial transactions, and employee data from the database, modify pricing information, or delete critical business records.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 23, 2026

SQL injection in Simple Laundry System 1.0's /checklogin.php parameter handler allows unauthenticated remote attackers to manipulate the Username field and execute arbitrary database queries. Public exploit code exists for this vulnerability, increasing the risk of active exploitation. No patch is currently available, leaving affected PHP installations vulnerable to data theft and unauthorized access.

Earlier versions of this analysis (1)

v1 Mar 23, 2026 - 09:45 CVSS 6.9

A SQL injection vulnerability exists in the code-projects Simple Laundry System 1.0, specifically in the /checklogin.php file where the Username parameter is not properly sanitized. An unauthenticated remote attacker can exploit this weakness to inject malicious SQL commands, potentially compromising the confidentiality, integrity, and availability of the application and its database. A public proof-of-concept exploit has been published on GitHub, significantly lowering the barrier to exploitation.

RemediationAI

No official patch or updated version has been released by code-projects as of this analysis (remediation level is unavailable per CVSS vector RL:X). Organizations currently running Simple Laundry System 1.0 should implement immediate compensatory controls including deploying a web application firewall (WAF) with SQL injection detection rules, restricting network access to the application to trusted IP ranges only, and implementing strict input validation at the network perimeter. Consider migrating to an alternative, actively maintained laundry management system with proper security support. Until migration is complete, monitor database logs for suspicious query patterns and unauthorized access attempts. Detailed vulnerability information is available from VulDB at https://vuldb.com/?id.352418 and the public exploit can be reviewed at https://github.com/anon387tdug/anon388/issues/1 to understand specific attack patterns for detection rules.

Affected VersionsENISA

Simple Laundry System 1.0

Affected Packages

euvd simple_laundry_system no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This vulnerability affects code-projects Simple Laundry System version 1.0 (CPE: cpe:2.3:a:code-projects:simple_laundry_system:*:*:*:*:*:*:*:*), a PHP-based web application for managing laundry services. The root cause is CWE-89 (SQL Injection), where user-supplied input from the Username parameter in the checklogin.php authentication handler is incorporated into SQL queries without proper validation or parameterization. This classic input validation failure allows attackers to break out of the intended SQL query structure and execute arbitrary SQL commands against the backend database, potentially bypassing authentication, extracting sensitive data, modifying records, or executing administrative operations on the database server.

Know when Simple Laundry System gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

Low

Vulnerable system: Integrity

Low

Vulnerable system: Availability

Low

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 03, 2026 - 17:47 vuln.today

Public exploit code

CVE Published

Mar 23, 2026 - 09:33 nvd

MEDIUM 6.9

DescriptionCVE.org

A weakness has been identified in code-projects Simple Laundry System 1.0. Affected is an unknown function of the file /checklogin.php of the component Parameters Handler. This manipulation of the argument Username causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Executive ViewAI

Why It Matters

A critical SQL injection vulnerability in Simple Laundry System 1.0 allows unauthenticated attackers to directly access and manipulate the application database without authorization. With a public exploit actively available and no vendor patch released, any organization running this system faces immediate risk of data breach, system compromise, and operational disruption.

Business Impact: Severe

Compensating Controls

Deploy Web Application Firewall (WAF) with SQL injection detection rules; restrict network access to /checklogin.php via IP whitelisting and VPN-only access; disable the application if not business-critical; implement database activity monitoring and query logging; enforce principle of least privilege on database credentials; conduct daily log reviews for exploitation attempts; consider implementing a reverse proxy with input validation.

Threat Intelligence Overview

EPSS Score

0.0%

Top 92% exploitable

Exploit

POC

Public exploit code exists

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC Yes

EPSS 0.0%

Patch available No

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.