CVE-2026-5542
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A cross-site scripting (XSS) vulnerability was found in code-projects Simple Laundry System 1.0 in the file /modstaffinfo.php. Manipulating the userid argument allows remote script injection. The exploit has been publicly disclosed.
Risk Assessment
An attacker can remotely execute arbitrary scripts in the victim's browser, potentially leading to session theft or account takeover.
Recommendation
Apply a patch from the vendor immediately or remove the /modstaffinfo.php file if not essential.
Original NVD description (English source)
A vulnerability was determined in code-projects Simple Laundry System 1.0. Impacted is an unknown function of the file /modstaffinfo.php of the component Parameter Handler. Executing a manipulation of the argument userid can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.