CVE-2026-5541
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
The Simple Laundry System 1.0 has an XSS vulnerability in the file /modmemberinfo.php. Manipulation of the userid argument leads to reflected XSS. The attack can be launched remotely, and the exploit has been published.
Risk Assessment
An attacker can inject malicious script that executes in the administrator's browser, potentially leading to session theft or data modification.
Recommendation
Immediately apply patches from the vendor or temporarily disable the member modification function.
Other vulnerabilities in Simple Laundry System
See all- CVE-2026-5825Medium
code-projects Simple Laundry System 1.0 has a cross-site scripting vulnerability in /delmemberinfo.php via the userid argument. The attack can be initiated remotely. The exploit is public and may be used.
- CVE-2026-5824High
In Simple Laundry System 1.0, the file /userchecklogin.php is vulnerable to SQL injection via the userid parameter. The attack can be launched remotely and the exploit has been disclosed.
- CVE-2026-5565High
A SQL injection vulnerability was found in Simple Laundry System 1.0 in the file /delmemberinfo.php via the userid parameter. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-5564High
A SQL injection vulnerability was found in Simple Laundry System 1.0 in the file /searchguest.php via the searchServiceId parameter. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-5542Medium
A cross-site scripting (XSS) vulnerability was found in code-projects Simple Laundry System 1.0 in the file /modstaffinfo.php. Manipulating the userid argument allows remote script injection. The exploit has been publicly disclosed.
- CVE-2026-5539Medium
The Simple Laundry System 1.0 has an XSS vulnerability in the file /modifymember.php. Manipulation of the firstName argument leads to reflected XSS. The attack can be launched remotely, and the exploit has been published.
Original NVD description (English source)
A vulnerability was found in code-projects Simple Laundry System 1.0. This issue affects some unknown processing of the file /modmemberinfo.php of the component Parameter Handler. Performing a manipulation of the argument userid results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS