CVE-2026-4579
Published: 23 March 2026
Summary
CVE-2026-4579 is a medium-severity Injection (CWE-74) vulnerability in Code-Projects Simple Laundry System. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 34.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-4579 is a SQL injection vulnerability (CWE-74, CWE-89) identified in code-projects Simple Laundry System 1.0, published on 2026-03-23. It affects an unknown function in the file /viewdetail.php of the Parameters Handler component, where manipulation of the serviceId argument enables SQL injection.
Remote attackers require no privileges or user interaction to exploit this vulnerability, as reflected in its CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Successful exploitation can result in low impacts to confidentiality, integrity, and availability. A public exploit is available and might be used.
Advisories and related resources, including VulDB entries (ctiid.352416, id.352416, submit.775209), a GitHub issue at anon387tdug/anon388/issues/3, and the project site at code-projects.org, provide further details on the issue.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-14388
Vulnerability details
A vulnerability was identified in code-projects Simple Laundry System 1.0. This affects an unknown function of the file /viewdetail.php of the component Parameters Handler. The manipulation of the argument serviceId leads to sql injection. Remote exploitation of the attack is…
more
possible. The exploit is publicly available and might be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in unauthenticated public-facing web app (/viewdetail.php) directly enables remote exploitation of the application per T1190; low-impact DB read/write follows from the same vector but does not map to additional distinct techniques.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces validation of the serviceId parameter in /viewdetail.php to prevent SQL injection manipulation.
Requires identification, reporting, and correction of the specific SQL injection flaw in the Parameters Handler component.
Vulnerability scanning detects the SQL injection vulnerability in Simple Laundry System 1.0 for timely remediation.