This vulnerability affects code-projects Simple Laundry System 1.0 in the /modstaffinfo.php file's Parameter Handler component. An attacker can manipulate the userid parameter to inject malicious scripts, resulting in cross-site scripting (XSS). The vulnerability is remotely exploitable without privileges and requires user interaction. The CVSS 4.0 score of 5.3 reflects a medium severity impact. No official fix or patch has been published, and the vendor has not provided remediation guidance. The exploit has been publicly disclosed but is not known to be actively exploited in the wild.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability requires user interaction and does not require privileges, increasing its risk. However, the impact is limited to the affected application and does not indicate direct system compromise or data breach.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or output encoding on the userid parameter to mitigate XSS risks. Monitoring for updates from the vendor or security advisories is recommended.