EUVD-2026-19032Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Despite a moderate CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:N/UI:R), real-world risk is elevated by the convergence of multiple signals: (1) publicly available exploit code reduces the exploitation barrier; (2) unauthenticated remote attack vector (PR:N, AV:N) allows any internet user to craft malicious requests; (3) low attack complexity (AC:L) requires no special techniques; (4) the UI:R component (user interaction required) is the primary limiting factor but is common in social engineering scenarios. The CVSS Exploitation metric (E:P) reflects proof-of-concept availability. For a legacy PHP application managing laundry system accounts, XSS can enable credential theft, session hijacking, or unauthorized administrative actions. The real risk depends on whether Simple Laundry System instances are internet-facing and whether userid values can be stored (persistent XSS) versus merely reflected (reflected XSS). |
| Exploit ScenarioDerived | An attacker crafts a malicious URL containing JavaScript payload in the userid parameter (e.g., /modmemberinfo.php?userid=<script>alert('XSS')</script>) and tricks a system administrator or user into clicking the link via phishing email or social engineering. When the user visits the page, the injected script executes in their browser with their session privileges, potentially stealing their authentication cookie or performing unauthorized actions (e.g., modifying member information, escalating privileges). The existence of public exploit code in the referenced GitHub issue (https://github.com/boyslikesports/vul-web/issues/3) reduces the barrier for opportunistic attackers to weaponize this vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 05, 2026
Stored or reflected cross-site scripting (XSS) in code-projects Simple Laundry System 1.0 allows remote attackers to inject malicious scripts via the userid parameter in /modmemberinfo.php, potentially compromising user sessions or stealing sensitive data. The vulnerability requires user interaction (UI:R) and publicly available exploit code exists, elevating the practical risk despite the moderate CVSS 4.3 score.
RemediationAI
Apply a vendor-released security patch if available from code-projects (https://code-projects.org/); however, no specific patched version number is confirmed in available data. Immediate interim controls should include: (1) implement strict input validation on the userid parameter to reject or encode special characters (< > " ' &); (2) apply HTML entity encoding or output escaping to all reflected userid values before rendering in HTML context; (3) deploy a Web Application Firewall (WAF) rule to block requests containing script tags in userid parameters; (4) implement Content Security Policy (CSP) headers with appropriate directives to prevent inline script execution; (5) consider deprecating Simple Laundry System 1.0 in favor of a maintained alternative if the vendor does not release patches promptly. Monitor code-projects.org for security advisories.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from improper input validation in the Parameter Handler component of Simple Laundry System, a PHP-based web application (CWE-79: Improper Neutralization of Input During Web Page Generation). The /modmemberinfo.php file fails to sanitize or encode the userid parameter before rendering it in the HTML response, allowing attackers to inject arbitrary JavaScript code. This is a classic XSS flaw affecting PHP applications that handle user-controlled input without proper output encoding or Content Security Policy controls.
Know when Simple Laundry System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was found in code-projects Simple Laundry System 1.0. This issue affects some unknown processing of the file /modmemberinfo.php of the component Parameter Handler. Performing a manipulation of the argument userid results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Related Vulnerabilities in Simple Laundry System SQL Injection and XSS
View all 4More in Simple Laundry System
View allSQL injection in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to execute arbitrary SQ
SQL injection in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to extract, modify, or
SQL injection in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to extract, modify, or
SQL injection in Simple Laundry System 1.0's /checkregisitem.php parameter handler allows unauthenticated remote attacke
SQL injection in Simple Laundry System 1.0 PHP application allows unauthenticated remote attackers to execute arbitrary
SQL injection in Simple Laundry System 1.0's /checklogin.php parameter handler allows unauthenticated remote attackers t
SQL injection in Simple Laundry System 1.0's /checkupdatestatus.php parameter handler allows unauthenticated remote atta
SQL injection in Simple Laundry System 1.0 through the serviceId parameter in /viewdetail.php allows unauthenticated rem
Cross-site request forgery in code-projects Laundry System 1.0 allows an attacker to perform unauthorized actions on beh
Cross-site scripting (XSS) in code-projects Simple Laundry System 1.0 allows remote attackers to inject arbitrary script
Reflected cross-site scripting (XSS) in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers
Exploit-DB