A flaw exists in the SililaWijesinghe Food Ordering System that allows a remote attacker to manipulate the /Food-Ordering-System/admin/ path and trigger a directory listing. This exposes internal files and configuration information that should not be publicly available, potentially revealing sensitive data about the application.

The affected product is SililaWijesinghe Food Ordering System. Because the product does not use versioning, all releases from the code base up to the commit ba314e897e3365600461e5ea59432e39ceaa0fa5 may be impacted. No explicit version numbers are available from the vendor or advisory sources.

The CVSS score of 6.9 classifies the vulnerability as medium severity. The EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation. The attack can be launched remotely from any host with network access to the affected server, making it easily exploitable without local privileges.