CVE-2026-6032

CVE-2026-6032 is a cross-site scripting (XSS) vulnerability affecting Simple Laundry System version 1.0, specifically within the /checkcheckout.php file where the serviceId parameter is not properly sanitized. This allows attackers to inject malicious scripts that execute in users' browsers when they interact with the affected endpoint. The vulnerability carries a CVSS 3.1 score of 4.3 (Medium severity) with a network-based attack vector requiring no authentication or special privileges, though user interaction is necessary. The attack has low complexity and results in limited impact to integrity without affecting confidentiality or availability. The FAUCET Risk Score of 38.0/100 indicates moderate concern within the threat landscape. Public exploit code is available for this vulnerability, which increases operational risk. However, the EPSS score of 0.000350 suggests currently low exploitation probability in the wild, and the vulnerability is not tracked on the CISA Known Exploited Vulnerabilities list, indicating no confirmed active exploitation at this time. Organizations running Simple Laundry System 1.0 should prioritize patching given the public availability of exploit code.