EUVD-2025-17310Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious CSRF link
-
DeliveryDeliver to authenticated user
-
ExploitUser clicks link
-
ExecutionForged request executed
-
ImpactUnauthorized action performed
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V3 - Web Frontend Security Anti-CSRF tokens, SameSite cookies
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The victim must be authenticated to the Laundry System and must interact with the attacker's crafted request (e.g., click a link or submit a form). No special configuration is required; the default setup is vulnerable. |
| Impact | The CVSS 4.0 base score is 2.1 (Low), with vector AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N, indicating low impact. The EPSS score is 0.08% (24th percentile), suggesting low exploitation probability. A public exploit exists, but there is no evidence of active exploitation (not in CISA KEV). The SSVC decision would likely be 'Low' due to low technical impact and requirement for user interaction. Overall, this is a low-risk issue despite the public exploit. |
| Exploit ScenarioDerived | An attacker crafts a malicious link or form that, when clicked by an authenticated admin, changes the admin's password or modifies system settings. The exploit is publicly available, making it easy to execute. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 26, 2026
Cross-site request forgery in code-projects Laundry System 1.0 allows an attacker to perform unauthorized actions on behalf of an authenticated user. The vulnerability is triggered via a crafted request and requires user interaction. A public exploit is available, but no active exploitation has been reported.
Earlier versions of this analysis (1)
RemediationAI
No official patch is available from the vendor. As a workaround, implement CSRF tokens in all state-changing requests, validate the Origin or Referer headers, and ensure users log out after sessions. Additionally, educate users to avoid clicking suspicious links while authenticated. These mitigations may require code modification and could impact usability if not implemented carefully.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a Cross-Site Request Forgery (CSRF) classified under CWE-352. CSRF attacks exploit the trust a web application has in an authenticated user's browser, allowing an attacker to forge requests that execute unintended actions. The affected product is code-projects Simple Laundry System version 1.0, as identified by CPE cpe:2.3:a:code-projects:simple_laundry_system:1.0. The attack vector is network-based with low complexity, but requires the victim to be authenticated and to interact with the malicious request (e.g., clicking a link).
Know when Simple Laundry System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Requires user interaction (UI:R), low integrity impact (I:L), no confidentiality or availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was found in code-projects Laundry System 1.0. It has been declared as problematic. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Executive ViewAI
Organizations using A vulnerability should be aware of moderate risk from CVE-2025-5766, a cross-site request forgery vulnerability rated CVSS 4.3. Users could be tricked into performing unintended actions. Proof-of-concept code is publicly available. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: implement SameSite cookie attributes and anti-CSRF tokens.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
More in Simple Laundry System
View allSQL injection in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to execute arbitrary SQ
SQL injection in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to extract, modify, or
SQL injection in Simple Laundry System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via
SQL injection in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to extract, modify, or
SQL injection in Simple Laundry System 1.0's /checkregisitem.php parameter handler allows unauthenticated remote attacke
SQL injection in Simple Laundry System 1.0 PHP application allows unauthenticated remote attackers to execute arbitrary
SQL injection in Simple Laundry System 1.0's /checklogin.php parameter handler allows unauthenticated remote attackers t
SQL injection in Simple Laundry System 1.0's /checkupdatestatus.php parameter handler allows unauthenticated remote atta
SQL injection in Simple Laundry System 1.0 through the serviceId parameter in /viewdetail.php allows unauthenticated rem
Cross-site scripting (XSS) in code-projects Simple Laundry System 1.0 allows remote attackers to inject arbitrary script
Reflected cross-site scripting (XSS) in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers
Cross-site scripting (XSS) in code-projects Simple Laundry System 1.0 allows remote attackers to inject malicious script
Exploit-DB