The Simple Laundry System 1.0 contains a flaw in the /modify.php file where the firstName parameter is not properly sanitized, enabling cross‑site scripting. A malicious actor can include JavaScript code in the firstName field, which will execute in the browser of any user who views the affected page. This mechanism is a typical example of CWE‑79, as the vulnerability arises from improper handling of user‑supplied input that is reflected in a rendered web page.

The issue exists in the code‑projects Simple Laundry System version 1.0. No other versions are mentioned as affected.

The CVSS base score of 5.3 indicates a moderate severity level, and the EPSS score of less than 1 % suggests that exploitation of this flaw is unlikely to be widespread at present. It is not listed in the CISA KEV catalog. The description states the attack may be initiated remotely via a crafted firstName parameter in an HTTP request. It is unclear whether authentication is required; the data provided does not indicate that only privileged users can trigger the flaw, but remote clients can supply the malicious payload.