This vulnerability affects the Simple Laundry System 1.0 by code-projects. It arises from improper sanitization of the userid parameter in the /delmemberinfo.php script, allowing an attacker to inject malicious scripts that execute in the context of a victim's browser. The vulnerability is remotely exploitable without privileges and does not require user authentication, but does require user interaction to trigger. The CVSS 4.0 base score is 5.3, indicating medium severity. No official fix or patch has been published as of the current data.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application for users who interact with the malicious payload. This could lead to session hijacking, defacement, or other client-side attacks depending on the injected script. However, the impact is limited by the need for user interaction and the lack of privilege requirements.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying input validation or output encoding on the userid parameter in /delmemberinfo.php to prevent script injection. Additionally, employing web application firewalls (WAFs) to detect and block XSS payloads may help mitigate exploitation risk.