CVE-2026-4784

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in code-projects Simple Laundry System 1.0. This affects an unknown function of the file /checkcheckout.php of the component Parameter Handler. The manipulation of the argument serviceId results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Mar 25, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-478407.5A network attacker positioned between UAA and its LDAP directory can impersonate the directory using any certificate from any trusted CA, th CVE-2026-478417.4An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session CVE-2026-478426.5Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode en CVE-2026-478433.7In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previousl CVE-2026-478443.7In specific scenarios, the Reactor Netty HTTP Server may leak exception details across unrelated requests. In order for this to happen, the CVE-2026-478455.3In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled. In order f CVE-2026-478469.8Bitnami Cassandra container images are affected by a retained default superuser vulnerability. When a custom administrator account is config CVE-2026-478475.3Bitnami MariaDB Galera container images and Helm chart are affected by a hardcoded default credential vulnerability in the Galera replicatio CVE-2026-478486.1In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials CVE-2026-478497.1Spring Data REST does not guard identifier (@Id) and version (@Version) properties against mutation via RFC 6902 JSON Patch (application/jso CVE-2026-47856.4The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th CVE-2026-478504.3Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immut