EUVD-2026-20815
GHSA-49pj-869r-v4q9
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | While the CVSS score of 4.3 is numerically low, multiple factors elevate real-world risk: the attack vector is network-accessible (AV:N), requires no authentication (PR:N), has low complexity (AC:L), and publicly available exploit code exists. The critical limitation is user interaction (UI:R), meaning the victim must click a malicious link or be redirected to the vulnerable endpoint. The CVSS vector includes E:P (exploit code maturity: proof-of-concept), confirming public exploit availability. The integrity impact (I:L) is limited but sufficient for session hijacking, defacement, or credential harvesting in a small-scale deployment scenario. SSVC assessment: exploitation status is 'active' (public POC), technical impact is 'integrity' (user session compromise), and the attack is not easily automatable across heterogeneous targets due to application-specific deployment contexts. This is a legitimate low-to-medium priority vulnerability for organizations running Simple Laundry System 1.0, particularly small businesses managing customer data, but does not warrant emergency response given the UI requirement and limited scope of impact. |
| Exploit ScenarioDerived | An attacker crafts a malicious URL containing JavaScript payload in the userid parameter (e.g., /delmemberinfo.php?userid=<script>alert('xss')</script>) and sends it to a laundry system administrator via email or embeds it in a website. When the administrator clicks the link, the script executes in their browser, potentially stealing session cookies, redirecting them to a phishing site, or performing unauthorized account modifications. The low barrier to exploitation (no authentication, network-accessible endpoint) combined with public POC code on GitHub lonelyuan/vunls/issues/10 makes this a practical attack vector for low-skill threat actors targeting small business installations. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 09, 2026
Stored or reflected cross-site scripting (XSS) in code-projects Simple Laundry System 1.0 allows remote attackers to inject malicious scripts via the userid parameter in /delmemberinfo.php, compromising user session integrity and enabling credential theft or malware distribution. The vulnerability requires user interaction (CVSS UI:R) but carries a CVSS score of 4.3 (low severity). Publicly available exploit code exists and the attack vector is network-accessible with no authentication required (AV:N, PR:N).
RemediationAI
Apply input validation and output encoding to the userid parameter in /delmemberinfo.php. Implement server-side sanitization using a whitelist approach for the userid parameter (alphanumeric and expected format only) and HTML-encode all user-supplied data before rendering in responses. If a patched version is available from code-projects (verify at https://code-projects.org/), upgrade immediately. As an interim mitigation, restrict access to /delmemberinfo.php using web application firewall rules to block requests containing JavaScript keywords (e.g., 'script', 'onerror', 'onclick') in the userid parameter. Refer to VulDB advisory at https://vuldb.com/vuln/356272 for additional details. OWASP CWE-79 remediation guidance recommends implementing Content Security Policy (CSP) headers to prevent inline script execution.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a CWE-79 improper neutralization of input during web page generation (cross-site scripting), specifically affecting the /delmemberinfo.php endpoint in a PHP-based laundry management application. The userid parameter is not sanitized or properly encoded before being rendered in the HTML response, allowing attackers to inject arbitrary JavaScript code that executes in the context of victim browsers. This is a classic stored or reflected XSS flaw common in legacy PHP applications that lack input validation and output encoding mechanisms. The CPE cpe:2.3:a:code-projects:simple_laundry_system:*:*:*:*:*:*:*:* indicates the entire Simple Laundry System product line is affected, with version 1.0 explicitly confirmed vulnerable.
Know when Simple Laundry System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was detected in code-projects Simple Laundry System 1.0. This vulnerability affects unknown code of the file /delmemberinfo.php. Performing a manipulation of the argument userid results in cross site scripting. The attack can be initiated remotely. The exploit is now public and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Related Vulnerabilities in Simple Laundry System Input Validation
View all 2More in Simple Laundry System
View allSQL injection in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to execute arbitrary SQ
SQL injection in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to extract, modify, or
SQL injection in Simple Laundry System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via
SQL injection in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to extract, modify, or
SQL injection in Simple Laundry System 1.0's /checkregisitem.php parameter handler allows unauthenticated remote attacke
SQL injection in Simple Laundry System 1.0 PHP application allows unauthenticated remote attackers to execute arbitrary
SQL injection in Simple Laundry System 1.0's /checklogin.php parameter handler allows unauthenticated remote attackers t
SQL injection in Simple Laundry System 1.0's /checkupdatestatus.php parameter handler allows unauthenticated remote atta
SQL injection in Simple Laundry System 1.0 through the serviceId parameter in /viewdetail.php allows unauthenticated rem
Cross-site request forgery in code-projects Laundry System 1.0 allows an attacker to perform unauthorized actions on beh
Cross-site scripting (XSS) in code-projects Simple Laundry System 1.0 allows remote attackers to inject arbitrary script
Reflected cross-site scripting (XSS) in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers
Exploit-DB