# CVE-2026-5825: code-projects Simple Laundry System XSS in delmemberinfo.php

Source: https://junglewise.ai/threats/cve-2026-5825-code-projects-simple-laundry-system-xss-in-delmemberinfo-php  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-09. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-5825 · Severity: medium · CVSS 4.3 · Published 2026-04-09

A vulnerability exists in the Simple Laundry System, a web application used for managing laundry service operations. An attacker can use this flaw to execute malicious scripts in the browsers of other users, potentially leading to the theft of login sessions or unauthorized actions performed on their behalf. This could compromise the privacy of customers and the integrity of the system's data.

Technologies: [Code-Projects Simple Laundry System](https://junglewise.ai/threats/technologies/simple-laundry-system). Vendors: [Code-Projects](https://junglewise.ai/threats/vendors/code-projects).

## Quick answers

**Is CVE-2026-5825 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5825 being exploited in the wild.

**How severe is CVE-2026-5825?** Medium severity, with a CVSS score of 4.3, published 9 April 2026.

**Which products and versions are affected?** Code-Projects Simple Laundry System 1.0.

**Is there a fix for CVE-2026-5825?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-5825 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-5825?** Check whether you run Code-Projects Simple Laundry System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A reflected cross-site scripting (XSS) vulnerability exists in code-projects Simple Laundry System 1.0 within the /delmemberinfo.php component. The root cause is the failure to properly sanitize or encode the 'userid' GET parameter before reflecting it back into the HTML response. A remote, unauthenticated attacker can exploit this by tricking a user into clicking a specially crafted URL containing a malicious JavaScript payload. Successful exploitation allows for the execution of arbitrary script code in the context of the victim's browser, which can be used to steal session cookies or perform unauthorized actions. A public proof-of-concept (PoC) exists, but no official patch has been confirmed.

## Affected products

- code-projects Simple Laundry System 1.0

## Timeline

- 2026-03-25: disclosed: Vulnerability details and PoC shared on GitHub.
- 2026-04-09: advisory: CVE published.

## References

- [https://code-projects.org/](https://code-projects.org/)
- [https://github.com/lonelyuan/vunls/issues/10](https://github.com/lonelyuan/vunls/issues/10)
- [https://vuldb.com/submit/788334](https://vuldb.com/submit/788334)
- [https://vuldb.com/vuln/356272](https://vuldb.com/vuln/356272)
- [https://vuldb.com/vuln/356272/cti](https://vuldb.com/vuln/356272/cti)

## Related threats

- [code-projects Simple Laundry System SQL injection in userchecklogin.php](https://junglewise.ai/threats/cve-2026-5824-code-projects-simple-laundry-system-sql-injection-in)
- [code-projects Simple Laundry System SQL injection in delmemberinfo.php](https://junglewise.ai/threats/cve-2026-5565-code-projects-simple-laundry-system-sql-injection-in-delmemberinfo)
- [code-projects Simple Laundry System SQL injection in searchguest.php](https://junglewise.ai/threats/cve-2026-5564-code-projects-simple-laundry-system-sql-injection-in-searchguest)
- [code-projects Simple Laundry System XSS in modstaffinfo.php](https://junglewise.ai/threats/cve-2026-5542-code-projects-simple-laundry-system-xss-in-modstaffinfo-php)
- [code-projects Simple Laundry System XSS in modmemberinfo.php](https://junglewise.ai/threats/cve-2026-5541-code-projects-simple-laundry-system-xss-in-modmemberinfo-php)