The vulnerability exists in the file /modstaffinfo.php of the Simple Laundry System, where an attacker can manipulate the userid argument to inject arbitrary script content. This reflects the classic CWE‑79 cross‑site scripting weakness and, because the attacker controls input to the Parameter Handler, it could potentially execute server‑side code as indicated by the presence of CWE‑94. The primary impact is that a remote user could inject malicious JavaScript that would run in the browser of any viewing user, enabling session hijacking, credential theft, or defacement of pages.

Affected systems are installations of the code‑projects Simple Laundry System, version 1.0 as referenced in the description. The exploit targets the modstaffinfo.php module; no other versions or products are explicitly mentioned, so the scope appears limited to this component in that version.

The CVSS score of 5.3 indicates moderate risk. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, reducing immediate urgency. However, the attack vector is remote and publicly disclosed, meaning that with no patch available an attacker could feasibly exploit it on any exposed instance. The lack of a fix and the ability to run arbitrary client‑side code make the threat significant for authenticated and unauthenticated users if the application does not enforce proper access controls.