The Simple Laundry System 1.0 from code-projects contains a SQL injection vulnerability in the /delmemberinfo.php file within the Parameter Handler component. Specifically, the userid parameter is not properly sanitized, allowing an attacker to inject malicious SQL commands remotely without requiring privileges or user interaction. This vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. The vulnerability was publicly disclosed on April 5, 2026, but no official fix or patch has been provided by the vendor. No known active exploitation has been reported.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, modification, or deletion. The impact is rated medium based on the CVSS score and the potential for limited confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should consider implementing input validation and parameterized queries as temporary mitigations. Monitor vendor channels for updates and apply patches promptly once released.