What is the CVSS score of EUVD-2026-14388?

EUVD-2026-14388 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for EUVD-2026-14388?

Yes, a public proof-of-concept exploit is available for EUVD-2026-14388. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-14388?

Within 24 hours: Identify all systems running Simple Laundry System v1.0 and isolate from production if feasible; assess whether customer payment or personal data is stored. Within 7 days: Deploy Web Application Firewall (WAF) rules blocking SQL injection patterns on the /viewdetail.php endpoint; implement input validation and parameterized queries if source code access is available. Within 30 days: Upgrade to a patched version when available, or migrate to an alternative supported laundry management solution; conduct database audit for unauthorized access.

Simple Laundry System EUVD-2026-14388

| CVE-2026-4579 MEDIUM

SQL Injection (CWE-89)

2026-03-23 VulDB

GHSA-xr35-94xw-8gm8

PHP SQLi Simple Laundry System Code Projects

5.5

CVSS 4.0 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-89 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Parameterized queries, prepared statements MITRE ATT&CK 2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	This vulnerability presents significant real-world risk despite the moderate CVSS score of 7.3. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates network-accessible exploitation with low complexity and no authentication required, making it highly automatable. The Exploit Proof-of-Concept (E:P) temporal metric confirms public exploit availability via GitHub (https://github.com/anon387tdug/anon388/issues/3), substantially increasing exploitation likelihood. While there is no evidence of KEV listing or active widespread exploitation, the combination of public exploit code, no authentication requirement, and network accessibility makes this a priority for remediation. Organizations running this software face immediate risk of data breach, unauthorized access, and potential system compromise. The exploit's public nature means even low-skill attackers can leverage it.
Exploit ScenarioDerived	An unauthenticated remote attacker accesses the publicly available /viewdetail.php endpoint and crafts a malicious HTTP request with SQL injection payload in the serviceId parameter, such as '1 OR 1=1 UNION SELECT username,password FROM users--'. Because the application fails to sanitize this input, the injected SQL executes against the backend database, allowing the attacker to extract sensitive data including user credentials, customer information, and transaction records. Using the publicly available GitHub proof-of-concept (https://github.com/anon387tdug/anon388/issues/3), even low-skilled attackers can successfully exploit this vulnerability with minimal effort.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 23, 2026

SQL injection in Simple Laundry System 1.0 through the serviceId parameter in /viewdetail.php allows unauthenticated remote attackers to execute arbitrary SQL queries. Public exploit code exists for this vulnerability, and no patch is currently available. Attackers can exploit this to read or modify sensitive database information.

Earlier versions of this analysis (1)

v1 Mar 23, 2026 - 07:45 CVSS 6.9

A SQL injection vulnerability exists in code-projects Simple Laundry System version 1.0, specifically in the /viewdetail.php file through the serviceId parameter. Attackers can exploit this remotely without authentication to gain unauthorized database access and potentially compromise data confidentiality, integrity, and availability. A proof-of-concept exploit has been publicly released on GitHub, significantly lowering the barrier for exploitation.

RemediationAI

No official patch or updated version from code-projects has been identified in available references (RL:X indicates unavailable remediation level). Organizations should immediately remove Simple Laundry System 1.0 from production environments or isolate it from network access until a fix is available. As interim mitigations, implement web application firewall (WAF) rules to detect and block SQL injection attempts targeting the serviceId parameter in /viewdetail.php, restrict access to the application to trusted IP ranges only, and deploy database-level access controls with least privilege principles. Review application logs for suspicious serviceId parameter values that may indicate exploitation attempts. Consider replacing this application with a maintained alternative that receives regular security updates.

Affected VersionsENISA

Simple Laundry System 1.0

Affected Packages

euvd simple_laundry_system no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This vulnerability affects code-projects Simple Laundry System version 1.0 (CPE: cpe:2.3:a:code-projects:simple_laundry_system:*:*:*:*:*:*:*:*), a PHP-based application for managing laundry services. The root cause is CWE-89 (SQL Injection), where the Parameters Handler in viewdetail.php fails to properly sanitize the serviceId parameter before incorporating it into SQL queries. This allows attackers to inject malicious SQL commands that are executed by the backend database, bypassing application logic and security controls. The vulnerability stems from inadequate input validation and lack of parameterized queries or prepared statements in the PHP codebase.

Know when Simple Laundry System gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

Low

Vulnerable system: Integrity

Low

Vulnerable system: Availability

Low

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 03, 2026 - 17:48 vuln.today

Public exploit code

CVE Published

Mar 23, 2026 - 07:36 nvd

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was identified in code-projects Simple Laundry System 1.0. This affects an unknown function of the file /viewdetail.php of the component Parameters Handler. The manipulation of the argument serviceId leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

Executive ViewAI

Why It Matters

A critical SQL injection vulnerability in Simple Laundry System v1.0 allows unauthenticated attackers to access and manipulate the organization's database. With a public exploit readily available, this represents an immediate risk to customer data, operational integrity, and regulatory compliance.

Business Impact: Severe

Compensating Controls

Deploy WAF rules to block SQL injection payloads targeting /viewdetail.php and the serviceId parameter; restrict network access to the application via IP whitelisting; disable the vulnerable endpoint if business-critical functionality permits; implement database activity monitoring (DAM) to detect exploitation attempts; enforce principle of least privilege on database accounts used by the application; conduct immediate security code review and implement parameterized queries as temporary mitigation until vendor patch is released.

Threat Intelligence Overview

EPSS Score

0.0%

Top 92% exploitable

Exploit

POC

Public exploit code exists

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC Yes

EPSS 0.0%

Patch available No

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.