Is there a public PoC exploit available for CVE-2026-5825?

Yes, a public proof-of-concept exploit is available for CVE-2026-5825. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-5825

Q: What is the CVSS score of CVE-2026-5825?

CVE-2026-5825 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-20815 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-04-09 VulDB

GHSA-49pj-869r-v4q9

PHP XSS Simple Laundry System Code Projects

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 09, 2026 - 01:16 vuln.today

Public exploit code

EUVD ID Assigned

Apr 09, 2026 - 01:00 euvd

EUVD-2026-20815

Analysis Generated

Apr 09, 2026 - 01:00 vuln.today

CVE Published

Apr 09, 2026 - 00:15 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was detected in code-projects Simple Laundry System 1.0. This vulnerability affects unknown code of the file /delmemberinfo.php. Performing a manipulation of the argument userid results in cross site scripting. The attack can be initiated remotely. The exploit is now public and may be used.

AnalysisAI

Stored or reflected cross-site scripting (XSS) in code-projects Simple Laundry System 1.0 allows remote attackers to inject malicious scripts via the userid parameter in /delmemberinfo.php, compromising user session integrity and enabling credential theft or malware distribution. The vulnerability requires user interaction (CVSS UI:R) but carries a CVSS score of 4.3 (low severity). Publicly available exploit code exists and the attack vector is network-accessible with no authentication required (AV:N, PR:N).

Technical ContextAI

The vulnerability is a CWE-79 improper neutralization of input during web page generation (cross-site scripting), specifically affecting the /delmemberinfo.php endpoint in a PHP-based laundry management application. The userid parameter is not sanitized or properly encoded before being rendered in the HTML response, allowing attackers to inject arbitrary JavaScript code that executes in the context of victim browsers. This is a classic stored or reflected XSS flaw common in legacy PHP applications that lack input validation and output encoding mechanisms. The CPE cpe:2.3:a:code-projects:simple_laundry_system:*:*:*:*:*:*:*:* indicates the entire Simple Laundry System product line is affected, with version 1.0 explicitly confirmed vulnerable.

RemediationAI

Apply input validation and output encoding to the userid parameter in /delmemberinfo.php. Implement server-side sanitization using a whitelist approach for the userid parameter (alphanumeric and expected format only) and HTML-encode all user-supplied data before rendering in responses. If a patched version is available from code-projects (verify at https://code-projects.org/), upgrade immediately. As an interim mitigation, restrict access to /delmemberinfo.php using web application firewall rules to block requests containing JavaScript keywords (e.g., 'script', 'onerror', 'onclick') in the userid parameter. Refer to VulDB advisory at https://vuldb.com/vuln/356272 for additional details. OWASP CWE-79 remediation guidance recommends implementing Content Security Policy (CSP) headers to prevent inline script execution.