The flaw allows an attacker to inject arbitrary JavaScript through the item name or description fields in the /item route, because the input is not properly validated or escaped. When a vulnerable page is viewed, the browser executes the injected script in the context of that user, enabling session hijacking, defacement, or data theft. This reflects a client‑side code injection problem aligned with CWE‑79 and improper input handling (CWE‑94).

The affected product is code‑projects Invoice System in Laravel 1.0. Any deployment that exposes the /item route and stores or echoes unsanitized item name or description values is vulnerable. No other editions or components are listed in the advisory.

The CVSS score of 5.1 denotes medium severity, while the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not in the CISA KEV catalog. The likely attack vector is remote: an attacker can send crafted requests over the network to inject the payload, and the impact propagates to any user who subsequently views the vulnerable page.