EUVD-2025-17304Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to system
-
DeliveryNavigate to edit_laundry.php
-
ExploitInject XSS payload in Customer parameter
-
ExecutionVictim views record
-
ImpactScript executes in victim's browser
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A03:2021 - Injection
ASVS 5.0
V5 - Validation, Sanitization and Encoding Input validation, output encoding, parameterized queries
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires authentication (PR:L) and user interaction (UI:P) - the attacker must be a logged-in user, and the victim must view the edited record. The attack is remote (AV:N) with low complexity (AC:L). |
| Impact | CVSS 4.0 base score is 2.0 (Low) with vector AV:N/AC:L/AT:N/PR:L/UI:P, indicating low impact (VI:L) and requiring low privileges and user interaction. EPSS score is 0.05% (16th percentile), suggesting very low exploitation probability. A public POC exists but no KEV listing. Overall risk is low due to low impact and required authentication. |
| Exploit ScenarioDerived | An authenticated user with access to the laundry system edits a customer record and injects a malicious script in the Customer field. When another user views the record, the script executes, potentially stealing session cookies or performing actions on behalf of the victim. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 26, 2026
Cross-site scripting (XSS) in code-projects Laundry System 1.0 allows an authenticated attacker to inject arbitrary JavaScript via the Customer parameter in /data/edit_laundry.php. A public exploit exists, but no active exploitation has been reported; EPSS score is low (0.05%).
Earlier versions of this analysis (1)
RemediationAI
No official patch is available from the vendor. As a workaround, sanitize the Customer input in /data/edit_laundry.php using HTML encoding or a security library. Alternatively, restrict access to the edit_laundry.php endpoint to trusted users only. Note that these mitigations may require code modification.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a stored XSS (CWE-79) in a PHP-based laundry management system. The affected component is the edit_laundry.php script, which fails to sanitize the Customer input before rendering it in the browser. The CPE indicates the product is 'simple_laundry_system' version 1.0 from code-projects.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Requires low privileges and user interaction; low impact on confidentiality and integrity.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was found in code-projects Laundry System 1.0. It has been classified as problematic. This affects an unknown part of the file /data/edit_laundry.php. The manipulation of the argument Customer leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Executive ViewAI
CVE-2025-5765 is a low-severity vulnerability in A vulnerability involving cross-site scripting (CVSS 3.5). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation. Apply vendor updates when available as part of routine maintenance.
Apply vendor patch during routine maintenance. Standard cross-site scripting mitigations apply if patching is delayed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB