CVE-2026-5542

A cross-site scripting (XSS) vulnerability has been identified in code-projects Simple Laundry System version 1.0. The issue resides in the /modstaffinfo.php file, where the userid parameter is processed without proper sanitization or output encoding [1]. This flaw enables attackers to inject malicious script code that is directly rendered in the victim's browser.

The vulnerability can be exploited remotely without authentication. An attacker simply crafts a URL containing a malicious script in the userid parameter and tricks a victim into visiting it. For example, the payload `` can be injected via the parameter [1]. No special privileges or network access beyond basic web interaction is required.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the affected web application. This can lead to theft of cookies, session tokens, or other sensitive information, as well as performing actions on behalf of the victim, defacing web pages, or redirecting users to malicious sites [1]. The impact is significant given the potential for complete compromise of user sessions and data.

As of the publication date, no official patch has been released. The vendor recommends output encoding of user input as a mitigation [1]. Users should apply input validation and output encoding to the userid parameter and consider using a Web Application Firewall (WAF) until an update is available.