Is there a public PoC exploit available for CVE-2026-6032?

Yes, a public proof-of-concept exploit is available for CVE-2026-6032. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-6032

Q: What is the CVSS score of CVE-2026-6032?

CVE-2026-6032 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21329 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-04-10 VulDB

GHSA-98g2-jqvc-f33c

PHP XSS Simple Laundry System Code Projects

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 10, 2026 - 08:16 vuln.today

Public exploit code

EUVD ID Assigned

Apr 10, 2026 - 07:30 euvd

EUVD-2026-21329

Analysis Generated

Apr 10, 2026 - 07:30 vuln.today

CVE Published

Apr 10, 2026 - 07:15 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was found in code-projects Simple Laundry System 1.0. This impacts an unknown function of the file /checkcheckout.php. Performing a manipulation of the argument serviceId results in cross site scripting. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

AnalysisAI

Reflected cross-site scripting (XSS) in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to inject arbitrary JavaScript via the serviceId parameter in /checkcheckout.php, requiring user interaction to execute. Publicly available exploit code exists for this vulnerability, and the low CVSS score of 4.3 reflects the need for user click-through and limited scope (integrity impact only), though the attack vector is network-accessible and requires no special privileges or authentication.

Technical ContextAI

The vulnerability is a reflected cross-site scripting (XSS) flaw classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), a common web application vulnerability class. The Simple Laundry System is a PHP-based web application, and the flaw exists in the /checkcheckout.php file where user-supplied input from the serviceId parameter is not properly sanitized or encoded before being returned in the HTTP response. This allows an attacker to craft a malicious URL containing JavaScript code that executes in the victim's browser within the security context of the vulnerable application. The affected product spans all versions of Simple Laundry System as indicated by the CPE wildcard pattern cpe:2.3:a:code-projects:simple_laundry_system:*:*:*:*:*:*:*:*.

RemediationAI

Implement input validation and output encoding on the serviceId parameter in /checkcheckout.php to prevent XSS injection. Specifically, use context-appropriate encoding (HTML entity encoding for HTML context, JavaScript escaping for JavaScript context, or URL encoding for URL context) on all user-supplied input before rendering it in the HTTP response. Additionally, implement a Content Security Policy (CSP) header to restrict script execution sources and reduce the impact of any reflected XSS. Contact code-projects at https://code-projects.org/ to request a patched version; if a patch is not available, consider disabling or restricting access to the vulnerable /checkcheckout.php endpoint until a fix is released. Web Application Firewall (WAF) rules can be configured to block requests containing common XSS payloads as a temporary mitigation.