The Simple Laundry System 1.0 by code-projects contains a cross-site scripting vulnerability in the /delmemberinfo.php script. Specifically, the userid argument is not properly sanitized, allowing an attacker to inject malicious scripts that execute in the context of the victim's browser. The vulnerability is remotely exploitable without privileges or authentication but requires user interaction to trigger. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, and partial impact on integrity. No official patch or fix has been published as of the vulnerability disclosure date.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of a victim's browser, potentially leading to session hijacking, defacement, or other malicious actions within the affected web application. Since the vulnerability is remotely exploitable and the exploit is publicly available, there is an increased risk of targeted attacks. However, the impact is limited to the scope of the affected web application and requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, users should consider applying input validation and output encoding on the userid parameter in /delmemberinfo.php to mitigate the XSS risk. Additionally, employing web application firewalls (WAFs) to detect and block malicious payloads targeting this parameter may reduce exposure. Monitor vendor channels for updates or official patches.