Which versions of PHP are affected by CVE-2026-5540?

Simple Laundry System 1.0 contains an unauthenticated SQL injection vulnerability in the member modification function that allows remote attackers to directly access and manipulate the application…

Is there a public PoC exploit available for CVE-2026-5540?

Yes, a public proof-of-concept exploit is available for CVE-2026-5540. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-5540?

Within 24 hours: Identify all systems running Simple Laundry System 1.0 and isolate affected instances from external network access or place behind WAF rules blocking SQL metacharacters in the firstName parameter. Within 7 days: Implement input validation and parameterized queries as interim code-level mitigations; audit database access logs for unauthorized SQL activity. Within 30 days: Migrate to a patched version of the laundry system or replace with a maintained alternative, as no vendor patch is available for version 1.0.

PHP CVE-2026-5540

Q: What is the CVSS score of CVE-2026-5540?

CVE-2026-5540 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19030 MEDIUM

SQL Injection (CWE-89)

2026-04-05 VulDB

PHP SQLi Simple Laundry System Code Projects

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 05, 2026 - 04:45 euvd

EUVD-2026-19030

Analysis Generated

Apr 05, 2026 - 04:45 vuln.today

CVE Published

Apr 05, 2026 - 03:45 nvd

MEDIUM 6.9

DescriptionCVE.org

A vulnerability has been found in code-projects Simple Laundry System 1.0. This vulnerability affects unknown code of the file /modifymember.php of the component Parameter Handler. Such manipulation of the argument firstName leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in Simple Laundry System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the firstName parameter in /modifymember.php. Publicly available exploit code exists (GitHub POC), enabling attackers to extract, modify, or delete database contents without authentication. CVSS 7.3 reflects network-based attack with low complexity and no privilege requirements. Not listed in CISA KEV, indicating no confirmed widespread exploitation despite public POC availability.

Technical ContextAI

This is a classic SQL injection vulnerability (CWE-89) in a PHP-based web application. The /modifymember.php endpoint's parameter handler fails to sanitize or parameterize the firstName input before incorporating it into SQL queries. Code-projects Simple Laundry System 1.0 (CPE: cpe:2.3:a:code-projects:simple_laundry_system:*:*:*:*:*:*:*:*) is an open-source project for managing laundry service operations. SQL injection occurs when untrusted data is concatenated directly into SQL statements, allowing attackers to break out of the intended query logic and inject malicious SQL commands. The vulnerability's placement in a member modification function suggests it affects core user management functionality, potentially exposing customer data, service records, and authentication credentials stored in the backend database.

RemediationAI

No vendor-released patch identified at time of analysis. The code-projects repository (https://code-projects.org/) should be monitored for updated releases addressing CVE-2026-5540. Immediate mitigation requires manual code remediation: implement parameterized SQL queries (prepared statements) in /modifymember.php to prevent SQL injection on the firstName parameter and all other user-controlled inputs. Apply input validation using allowlists for expected firstName formats (alphanumeric characters, length limits). Deploy a web application firewall (WAF) with SQL injection signature detection as a temporary compensating control. Restrict /modifymember.php access to authenticated administrative sessions only using application-level access controls or reverse proxy authentication. Database-level defenses include enforcing least-privilege principles for the application's database user account to limit SQLi impact. Organizations should consider migrating to actively maintained laundry management platforms with established security patch cycles. Review application logs for indicators of exploitation attempts targeting the firstName parameter with SQL metacharacters.