A cross‑site scripting flaw exists in the edit_food_items.php file of the Online Food Order System. Manipulating the dname argument allows an attacker to inject arbitrary JavaScript into the page rendered to other users. Because the input is not properly validated or encoded, malicious scripts can execute in the victim’s browser, potentially leading to session hijacking, defacement, or other client‑side attacks.

The vulnerability affects the code‑projects Online Food Order System, specifically version 1.0. No other versions or related products are listed as impacted.

The CVSS score of 5.1 indicates a moderate severity and the vulnerability is exploitable over the network, meaning a remote attacker can trigger it via a web request. The EPSS score is not available and the issue is not listed in the CISA KEV catalog. The exploitation path is straightforward: an attacker crafts a request to edit_food_items.php with a malicious dname value, and the resulting page renders the injected script for any user who views the page. Without remediation, this flaw remains publicly documented and could be leveraged by attackers.