Is there a public PoC exploit available for CVE-2026-6150?

Yes, a public proof-of-concept exploit is available for CVE-2026-6150. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-6150

Q: What is the CVSS score of CVE-2026-6150?

CVE-2026-6150 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21779 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-04-13 VulDB

GHSA-8f84-x6pj-qm67

PHP XSS Simple Laundry System Code Projects

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

CVSS changed

Apr 13, 2026 - 03:22 NVD

4.3 (MEDIUM) 5.3 (MEDIUM)

Analysis Generated

Apr 13, 2026 - 02:49 vuln.today

EUVD ID Assigned

Apr 13, 2026 - 02:45 euvd

EUVD-2026-21779

Analysis Generated

Apr 13, 2026 - 02:45 vuln.today

CVE Published

Apr 13, 2026 - 02:00 nvd

LOW 2.1

DescriptionCVE.org

A vulnerability has been found in code-projects Simple Laundry System 1.0. This affects an unknown part of the file /checkupdatestatus.php. The manipulation of the argument serviceId leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Cross-site scripting (XSS) in code-projects Simple Laundry System 1.0 allows remote attackers to inject arbitrary scripts via the serviceId parameter in /checkupdatestatus.php. The vulnerability requires user interaction (UI:R) and results in low integrity impact, but is publicly available with exploit code and has been disclosed. CVSS base score is 4.3 with relatively low real-world risk due to UI requirement and limited impact scope, though the presence of public POC increases adoption likelihood among less-skilled attackers.

Technical ContextAI

The vulnerability is a reflective or stored cross-site scripting (XSS) flaw classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The affected application Simple Laundry System 1.0 (CPE: cpe:2.3:a:code-projects:simple_laundry_system:*:*:*:*:*:*:*:*) fails to properly sanitize or validate user-supplied input in the serviceId parameter before outputting it to the /checkupdatestatus.php endpoint. This PHP-based application does not implement adequate output encoding or Content Security Policy (CSP) headers, allowing an attacker to inject malicious JavaScript that executes in the victim's browser context. The vulnerability operates at the HTTP application layer with network-level accessibility.

RemediationAI

Implement immediate input validation and output encoding in /checkupdatestatus.php by sanitizing the serviceId parameter using context-appropriate functions (e.g., htmlspecialchars() or htmlentities() for HTML context in PHP) and validating against an allowlist of expected values. Apply any available patch released by code-projects by visiting https://code-projects.org/ for updates. As an interim defense, deploy a Web Application Firewall (WAF) rule to detect and block script tags and JavaScript event handlers in the serviceId parameter, and implement a Content Security Policy (CSP) header to restrict inline script execution. If running Simple Laundry System 1.0, verify with the vendor whether a patched version is available; if not, consider disabling or restricting access to the /checkupdatestatus.php endpoint until remediation is confirmed.