CVE-2026-4784 is a SQL injection in code-projects Simple Laundry System 1.0, scored CVSS 7.3 (high). The serviceId argument in /checkcheckout.php is the entry point. The record names no vendor fix, so take the application off the internet, replace it, or fix the query yourself.
What's affected
The NVD record says code-projects Simple Laundry System 1.0 is affected, specifically the file /checkcheckout.php in the Parameter Handler component. Manipulating the argument serviceId results in SQL injection, and the attack can be launched remotely.
The record states that an exploit has been made public. That is the record's wording, and it is not a CISA KEV listing. The KEV flag is false.
The record names no fixed version and I found no vendor advisory. Check the vendor site yourself, since I could not read a vendor advisory. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.
How to check if you're exposed
- Find out whether you run this software. Search your web roots for a file named checkcheckout.php, for example
find /var/www -name checkcheckout.php. - Check your inventory and deployment records for a project named Simple Laundry System from code-projects.
- If it is present, check whether it is reachable from the internet, and who uses it.
- Review your web server and database logs for unusual requests to that file or unexpected database errors.
If the file is not present, you are not running this code.
What to do now
- Locate every copy of the application, including test and demo installs.
- If it is not needed, remove it.
- If it is needed, restrict access to a trusted network or put it behind authentication at the web server.
- Change the code to use prepared statements for the serviceId lookup and validate the value as an integer.
- Run the database account for the app with the fewest permissions, and rotate its credentials if you suspect misuse.
Why it matters
The weakness is CWE-89, SQL injection, grouped with CWE-74, injection in general. When user input is placed into a database query as text, the input can change the query itself. Prepared statements keep data and commands separate and are the standard fix.
Small downloadable projects are often copied into real sites, where nobody tracks or patches them. A dependency scan will not find a copied source folder, so a code inventory matters.
Quick check
Is CVE-2026-4784 exploited in the wild?
The record's KEV flag is false, and the pages I read do not say it is exploited. The record says an exploit is public, which is a different statement. Treat it as a patch item and keep an eye on the advisory for changes.
Is there a patch?
The record names none and I found no vendor advisory. Remove the app, restrict access, or fix the query in your own copy.
Sources
Last reviewed: 19 October 2026.
