Is there a public PoC exploit available for CVE-2026-5541?

Yes, a public proof-of-concept exploit is available for CVE-2026-5541. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-5541

Q: What is the CVSS score of CVE-2026-5541?

CVE-2026-5541 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19032 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-04-05 VulDB

PHP XSS Simple Laundry System Code Projects

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 05, 2026 - 04:45 euvd

EUVD-2026-19032

Analysis Generated

Apr 05, 2026 - 04:45 vuln.today

CVE Published

Apr 05, 2026 - 04:00 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was found in code-projects Simple Laundry System 1.0. This issue affects some unknown processing of the file /modmemberinfo.php of the component Parameter Handler. Performing a manipulation of the argument userid results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be used.

AnalysisAI

Stored or reflected cross-site scripting (XSS) in code-projects Simple Laundry System 1.0 allows remote attackers to inject malicious scripts via the userid parameter in /modmemberinfo.php, potentially compromising user sessions or stealing sensitive data. The vulnerability requires user interaction (UI:R) and publicly available exploit code exists, elevating the practical risk despite the moderate CVSS 4.3 score.

Technical ContextAI

The vulnerability stems from improper input validation in the Parameter Handler component of Simple Laundry System, a PHP-based web application (CWE-79: Improper Neutralization of Input During Web Page Generation). The /modmemberinfo.php file fails to sanitize or encode the userid parameter before rendering it in the HTML response, allowing attackers to inject arbitrary JavaScript code. This is a classic XSS flaw affecting PHP applications that handle user-controlled input without proper output encoding or Content Security Policy controls.

RemediationAI

Apply a vendor-released security patch if available from code-projects (https://code-projects.org/); however, no specific patched version number is confirmed in available data. Immediate interim controls should include: (1) implement strict input validation on the userid parameter to reject or encode special characters (< > " ' &); (2) apply HTML entity encoding or output escaping to all reflected userid values before rendering in HTML context; (3) deploy a Web Application Firewall (WAF) rule to block requests containing script tags in userid parameters; (4) implement Content Security Policy (CSP) headers with appropriate directives to prevent inline script execution; (5) consider deprecating Simple Laundry System 1.0 in favor of a maintained alternative if the vendor does not release patches promptly. Monitor code-projects.org for security advisories.