Is there a public PoC exploit available for CVE-2026-5542?

Yes, a public proof-of-concept exploit is available for CVE-2026-5542. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-5542

Q: What is the CVSS score of CVE-2026-5542?

CVE-2026-5542 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19034 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-04-05 VulDB

PHP XSS Simple Laundry System Code Projects

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 05, 2026 - 04:45 euvd

EUVD-2026-19034

Analysis Generated

Apr 05, 2026 - 04:45 vuln.today

CVE Published

Apr 05, 2026 - 04:15 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was determined in code-projects Simple Laundry System 1.0. Impacted is an unknown function of the file /modstaffinfo.php of the component Parameter Handler. Executing a manipulation of the argument userid can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

Cross-site scripting (XSS) in code-projects Simple Laundry System 1.0 allows remote attackers to inject malicious scripts via the userid parameter in /modstaffinfo.php, affecting confidentiality and integrity of user sessions. The vulnerability requires user interaction (clicking a crafted link) and has a publicly available exploit (CVSS 4.3, EPSS signal: E:P indicates public exploit availability). This is a stored or reflected XSS vulnerability in a PHP-based application with low CVSS severity but non-negligible real-world risk due to ease of exploitation and public disclosure.

Technical ContextAI

The vulnerability exists in the Parameter Handler component of Simple Laundry System, specifically in the /modstaffinfo.php file where the userid parameter is processed without proper input sanitization or output encoding. This is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) vulnerability in a PHP application. The userid parameter likely flows directly into HTML output or JavaScript context without being escaped, allowing attackers to inject arbitrary HTML/JavaScript code that executes in victims' browsers when they interact with the crafted parameter. The affected product is identified via CPE as code-projects Simple Laundry System version 1.0 and potentially other versions using the wildcard notation.

RemediationAI

Immediately upgrade code-projects Simple Laundry System to a patched version if available from the vendor at https://code-projects.org/; no specific patched version is confirmed in available data. As a workaround pending a vendor patch, implement input validation and output encoding: validate the userid parameter against a strict allowlist (numeric or alphanumeric pattern only), and HTML-encode all output of the userid parameter in /modstaffinfo.php using PHP functions such as htmlspecialchars() or htmlentities(). Deploy a Web Application Firewall (WAF) rule to block requests with special characters in the userid parameter. Consult the vendor advisory at https://code-projects.org/ for official patching guidance.