Is CVE-2026-5825 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5825 being exploited in the wild.

How severe is CVE-2026-5825?

Medium severity, with a CVSS score of 4.3, published 9 April 2026.

Is there a fix for CVE-2026-5825?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-5825 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-5825?

Check whether you run Code-Projects Simple Laundry System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5825: code-projects Simple Laundry System XSS in delmemberinfo.php

CVE-2026-5825 · Severity: medium · CVSS 4.3 · Published 2026-04-09

A vulnerability exists in the Simple Laundry System, a web application used for managing laundry service operations. An attacker can use this flaw to execute malicious scripts in the browsers of other users, potentially leading to the theft of login sessions or unauthorized actions performed on their behalf. This could compromise the privacy of customers and the integrity of the system's data.

Technologies: Code-Projects Simple Laundry System. Vendors: Code-Projects.

Quick answers

Is CVE-2026-5825 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5825 being exploited in the wild.
How severe is CVE-2026-5825?: Medium severity, with a CVSS score of 4.3, published 9 April 2026.
Which products and versions are affected?: Code-Projects Simple Laundry System 1.0.
Is there a fix for CVE-2026-5825?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-5825 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-5825?: Check whether you run Code-Projects Simple Laundry System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A reflected cross-site scripting (XSS) vulnerability exists in code-projects Simple Laundry System 1.0 within the /delmemberinfo.php component. The root cause is the failure to properly sanitize or encode the 'userid' GET parameter before reflecting it back into the HTML response. A remote, unauthenticated attacker can exploit this by tricking a user into clicking a specially crafted URL containing a malicious JavaScript payload. Successful exploitation allows for the execution of arbitrary script code in the context of the victim's browser, which can be used to steal session cookies or perform unauthorized actions. A public proof-of-concept (PoC) exists, but no official patch has been confirmed.

Affected products

code-projects Simple Laundry System 1.0

Timeline

2026-03-25: disclosed: Vulnerability details and PoC shared on GitHub.
2026-04-09: advisory: CVE published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.