The Simple Laundry System 1.0 by code-projects contains a cross-site scripting vulnerability in the /delstaffinfo.php file. Specifically, the userid parameter is not properly sanitized, allowing an attacker to inject malicious scripts that execute in the context of the victim's browser. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity, with network attack vector, low attack complexity, no privileges required, and user interaction needed. Exploits are publicly available, but no known exploits in the wild have been reported.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the victim's browser, potentially leading to session hijacking, defacement, or other client-side impacts. Since the attack requires user interaction, the risk is somewhat mitigated. There is no indication of server-side compromise or data breach from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected parameter or applying input validation and output encoding on the userid parameter to mitigate XSS risks. Monitor vendor channels for updates or patches.