The vulnerability is a client‑side cross‑site scripting flaw located in the checkcheckout.php module of code‑projects Simple Laundry System 1.0. By manipulating the serviceId query parameter, an attacker can inject arbitrary JavaScript into the page. This injection allows the attacker to run malicious code in the browsers of users who view the affected page, potentially leading to credential theft, session hijacking, or defacement. The flaw maps to CWE‑79 (Cross‑Site Scripting) and also reflects code‑injection concerns (CWE‑94).

Affected systems are the Simple Laundry System version 1.0 released by code‑projects. No other versions or products were identified in the CVE data. Operators of this web application should verify whether the deployed instance matches the impacted version.

The CVSS score of 5.3 classifies the issue as moderate, and the EPSS score is not provided. The vulnerability is exploitable remotely over HTTP by sending a crafted serviceId value, and exploit code has already been made public. Because the attack is performed via browser input, the risk depends on the number of users accessing the vulnerable page. Current mitigation depends on an official update; if unavailable, the attacker can easily carry out the exploit until a patch or input validation is applied.