CVE-2026-5541

A cross-site scripting (XSS) vulnerability exists in code-projects Simple Laundry System 1.0, specifically in the /modmemberinfo.php file. The userid parameter is taken from the HTTP request and directly rendered into the web page without proper encoding or sanitization, allowing attackers to inject arbitrary HTML or JavaScript [1].

Attackers can trigger the vulnerability remotely by crafting a malicious URL containing a payload in the userid parameter. No authentication is required to exploit this flaw, and public proof-of-concept code using `` has been released [1].

Successful exploitation enables an attacker to execute arbitrary scripts in the victim's browser session. This can lead to cookie theft, session hijacking, defacement, or redirection to malicious sites, potentially compromising user accounts and privacy [1].

As of the advisory, no patch has been released; users are advised to apply output encoding to the userid parameter or restrict access to the vulnerable file until an official update is available [1].