Which versions of PHP are affected by CVE-2026-5565?

CVE-2026-5565 is a critical SQL injection vulnerability in Simple Laundry System 1.0 that allows unauthenticated attackers to execute arbitrary database commands through the userid parameter,…

Is there a public PoC exploit available for CVE-2026-5565?

Yes, a public proof-of-concept exploit is available for CVE-2026-5565. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-5565?

Within 24 hours: Identify all instances of Simple Laundry System 1.0 in production and isolate or disable /delmemberinfo.php endpoint if operationally feasible; implement WAF rules to block SQL injection patterns on userid parameters. Within 7 days: Contact vendor for patch timeline; evaluate replacement or migration to patched laundry management system. Within 30 days: Complete migration away from affected version or implement compensating controls (input validation, parameterized queries at application layer, network segmentation).

PHP CVE-2026-5565

Q: What is the CVSS score of CVE-2026-5565?

CVE-2026-5565 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19077 MEDIUM

SQL Injection (CWE-89)

2026-04-05 VulDB

GHSA-cjhf-4v4f-qhjg

PHP SQLi Simple Laundry System Code Projects

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 05, 2026 - 12:30 euvd

EUVD-2026-19077

Analysis Generated

Apr 05, 2026 - 12:30 vuln.today

CVE Published

Apr 05, 2026 - 12:00 nvd

MEDIUM 6.9

DescriptionCVE.org

A security vulnerability has been detected in code-projects Simple Laundry System 1.0. Affected by this issue is some unknown functionality of the file /delmemberinfo.php of the component Parameter Handler. Such manipulation of the argument userid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

SQL injection in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the userid parameter in /delmemberinfo.php. The vulnerability has publicly available exploit code (GitHub POC) and CVSS 7.3 severity with network-accessible attack vector requiring low complexity and no privileges. No vendor-released patch identified at time of analysis. EPSS data not provided, but public exploit availability increases likelihood of opportunistic scanning and exploitation.

Technical ContextAI

This vulnerability affects the Parameter Handler component in Simple Laundry System 1.0, a PHP-based web application (CPE: cpe:2.3:a:code-projects:simple_laundry_system). The flaw is a classic SQL injection (CWE-89) in the /delmemberinfo.php file where the userid parameter is passed to a SQL query without proper sanitization or parameterization. SQL injection occurs when user-controlled input is concatenated directly into SQL statements, allowing attackers to break out of the intended query logic and inject malicious SQL commands. In PHP applications lacking prepared statements or input validation, POST/GET parameters like userid can be manipulated to append UNION clauses, boolean-based blind payloads, or time-based injection vectors to extract data, modify records, or bypass authentication. The file name 'delmemberinfo.php' suggests a member deletion function, which likely constructs a DELETE or SELECT query using the userid value without escaping or binding.

RemediationAI

No vendor-released patch identified at time of analysis. Primary remediation is to immediately restrict network access to /delmemberinfo.php and the entire application administrative interface via IP whitelisting, VPN, or removal from public-facing web servers until code-level fixes are implemented. As an interim workaround, implement input validation by modifying /delmemberinfo.php to sanitize the userid parameter using prepared statements (PDO with bound parameters in PHP: $stmt = $pdo->prepare('DELETE FROM members WHERE userid = :id'); $stmt->execute(['id' => $_POST['userid']])) or parameterized queries with mysqli_real_escape_string as a minimum (though prepared statements are strongly preferred). Organizations should conduct a comprehensive code review of all PHP files handling user input, as similar injection flaws likely exist in other parameter handlers. For vulnerability intelligence and disclosure details, reference VulDB entries at https://vuldb.com/vuln/355335 and the public exploit repository at https://github.com/mzhnqwqz/cve/issues/1. Consider migrating to actively maintained laundry management software with professional security support if code-projects does not issue timely patches.