EUVD-2026-19026
GHSA-rgqr-jrx3-5xwx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
6DescriptionCVE.org
A flaw has been found in code-projects Simple Laundry System 1.0. This affects an unknown part of the file /modifymember.php of the component Parameter Handler. This manipulation of the argument firstName causes cross site scripting. The attack can be initiated remotely. The exploit has been published and may be used.
AnalysisAI
Stored cross-site scripting (XSS) in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to inject malicious scripts via the firstName parameter in /modifymember.php, which are executed in the context of other users' browsers. The vulnerability has a CVSS score of 4.3 with low impact severity but publicly available exploit code, though exploitation requires user interaction (UI:R). This represents a typical reflected or stored XSS in a parameter handler with limited immediate risk due to no confidentiality or availability impact, though it enables session hijacking and credential theft.
Technical ContextAI
The vulnerability resides in a PHP-based parameter handler for the /modifymember.php endpoint in Simple Laundry System, a web application for managing laundry operations. The flaw is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation, also known as Cross-Site Scripting), indicating that user-supplied input (the firstName parameter) is not properly sanitized or encoded before being reflected or stored in HTML output. The absence of input validation or output encoding on the firstName field allows attackers to inject arbitrary JavaScript code that executes in victims' browsers when they visit a malicious link or when the application renders stored user data. The CPE identifier cpe:2.3:a:code-projects:simple_laundry_system:*:*:*:*:*:*:*:* indicates all versions up to and including 1.0 are affected.
RemediationAI
Organizations using Simple Laundry System should immediately upgrade to a patched version released by code-projects. Input validation and output encoding must be applied to the firstName parameter in /modifymember.php: all user inputs should be validated against an allowlist of permitted characters, and all output rendered in HTML context should be properly HTML-encoded (e.g., converting '<' to '<', '>' to '>', and quotes to their HTML entities). As a temporary workaround pending patches, disable or restrict access to the /modifymember.php endpoint using web server configuration, or implement a Web Application Firewall (WAF) rule to filter XSS payloads in the firstName parameter. For immediate guidance, consult the vendor advisory at https://code-projects.org/ and the VulDB entry at https://vuldb.com/vuln/355292.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today