This vulnerability involves an SQL injection in the Simple Laundry System 1.0 by code-projects. Specifically, the userid parameter in the /modstaffinfo.php file's Parameter Handler component is vulnerable to injection attacks that can be triggered remotely without authentication or user interaction. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low confidentiality, integrity, and availability impacts. The vulnerability was published on 2026-03-27, with no patch or vendor advisory available at this time.

Successful exploitation allows an unauthenticated remote attacker to inject SQL commands via the userid parameter, potentially leading to unauthorized data access or modification. The impact is rated medium severity with limited confidentiality, integrity, and availability impacts according to the CVSS vector. There are no confirmed active exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected /modstaffinfo.php endpoint and implement input validation or parameterized queries if possible. Monitor vendor channels for updates or patches addressing this vulnerability.