CVE-2026-4579 is an SQL injection flaw in code-projects Simple Laundry System 1.0, scored CVSS 7.3 (high). The serviceId argument of the viewdetail page is the injection point, and the record says remote exploitation is possible. No fixed version is named in the sources I fetched, so remove or isolate the app and check with the vendor.
What's affected
The NVD record lists code-projects Simple Laundry System version 1.0. The weak spot is the file /viewdetail.php, where the serviceId value is passed on without safe handling. The attack works over the network, needs no login and needs no user action, which is what the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L describes.
The public report on GitHub names version 1.0 and does not list a fixed release. The vendor site is code-projects.org, and I could not confirm any patch from it. Check there before assuming one exists.
How to check if you're exposed
- Find any deployment of Simple Laundry System. It is a PHP project, so look for the file /viewdetail.php under the web root.
- Confirm the version in your project files or release notes. Version 1.0 is the one named in the record.
- Look in web server logs for unusual requests to that file, especially odd characters in the serviceId value.
- Scan your repositories and images with the free tool at gold.safeguard.sh/scan to find copies you forgot about.
What to do now
- Take the application off the public internet if it is not essential.
- If you must keep it, put it behind a login-protected gateway or an IP allow list.
- Change the code to use prepared statements for every query, starting with /viewdetail.php.
- Give the database account only the rights the app needs.
- Ask the vendor for a patched release and record the answer.
Why it matters
The class is CWE-89, SQL injection, listed with the parent CWE-74, injection. User input becomes part of a database query, so a request can read or change data the page was never meant to expose. The record says an exploit is public. Its KEV flag is false, so it is not on the CISA list of exploited vulnerabilities.
Quick check
Is there a patch for CVE-2026-4579?
None was named in the sources I read. Treat the product as unpatched until the vendor says otherwise.
Sources
Last reviewed: 19 October 2026.
