Which versions of PHP are affected by EUVD-2026-15183?

A critical SQL injection vulnerability in Simple Laundry System version 1.0 allows unauthenticated attackers to remotely access, modify, or delete database information without authentication.

Is there a public PoC exploit available for EUVD-2026-15183?

Yes, a public proof-of-concept exploit is available for EUVD-2026-15183. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-15183?

Within 24 hours: Identify all systems running Simple Laundry System 1.0 and assess their internet exposure; implement network-level access restrictions to limit connectivity to the /checkcheckout.php endpoint. Within 7 days: Deploy Web Application Firewall (WAF) rules to block SQL injection patterns targeting the serviceId parameter; consider disabling the checkout feature if non-critical; establish monitoring for exploitation attempts. Within 30 days: Coordinate with the vendor for patch availability; evaluate replacement or migration to an alternative laundry management system; conduct forensic analysis to determine if the system has been previously compromised.

PHP EUVD-2026-15183

Q: What is the CVSS score of EUVD-2026-15183?

EUVD-2026-15183 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-4784 MEDIUM

SQL Injection (CWE-89)

2026-03-25 VulDB

GHSA-j37h-g6v5-pj8h

PHP SQLi Simple Laundry System Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 03, 2026 - 17:47 vuln.today

Public exploit code

EUVD ID Assigned

Mar 25, 2026 - 01:45 euvd

EUVD-2026-15183

Analysis Generated

Mar 25, 2026 - 01:45 vuln.today

CVE Published

Mar 25, 2026 - 01:09 nvd

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was found in code-projects Simple Laundry System 1.0. This affects an unknown function of the file /checkcheckout.php of the component Parameter Handler. The manipulation of the argument serviceId results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.

AnalysisAI

SQL injection in Simple Laundry System 1.0 PHP application allows unauthenticated remote attackers to execute arbitrary database queries through the serviceId parameter in /checkcheckout.php. Public exploit code exists for this vulnerability, and no patch is currently available.

Technical ContextAI

The vulnerability affects code-projects Simple Laundry System 1.0 (CPE: cpe:2.3:a:code-projects:simple_laundry_system:*:*:*:*:*:*:*:*), a PHP-based web application for managing laundry services. The root cause is CWE-89 (SQL Injection), which occurs when user-supplied input is not properly validated or sanitized before being incorporated into SQL queries. In this case, the serviceId parameter in the /checkcheckout.php file's Parameter Handler is vulnerable to SQL injection attacks, allowing attackers to manipulate database queries by injecting malicious SQL commands. This represents a fundamental input validation failure in the application's database interaction layer.

RemediationAI

No official patch or updated version has been identified in the available references, as indicated by the CVSS Remediation Level of Unavailable (RL:X). Organizations running Simple Laundry System 1.0 should immediately implement input validation and parameterized queries for the serviceId parameter in /checkcheckout.php as a code-level fix. As interim mitigations, deploy a web application firewall (WAF) configured with SQL injection detection rules to filter malicious requests targeting this parameter, restrict network access to the application to trusted IP ranges only, implement principle of least privilege for the database user account used by the application to limit potential damage from successful exploitation, and conduct thorough logging and monitoring of all requests to /checkcheckout.php for anomalous patterns. Consider replacing the application with a maintained alternative if vendor support and patching are not forthcoming, as the application appears to be an unmaintained code project based on the distribution source.