An input validation failure in the file /dbfood/food.php of the Online Food Ordering System allows an attacker to manipulate the cuisines parameter and inject arbitrary script code that executes in the victim’s browser. The flaw is triggered remotely and does not require authentication; the released exploit can be used to run code on any user who visits the vulnerable page.

Vulnerable product: Online Food Ordering System version 1.0 developed by code‑projects. The issue is specifically limited to the food.php script handling the cuisines argument and is not reported in other vendors’ products.

The CVSS score of 4.8 indicates moderate severity, and the EPSS score is not provided. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only a crafted HTTP request to the application, making it straightforward for anyone with network access to launch the attack. The absence of input validation or output encoding allows the injected script to run in the browser of any user interacting with the affected resource.