This vulnerability allows remote attackers to perform cross-site scripting attacks by manipulating the 'Name' argument in the /dbfood/contact.php file of code-projects Online Food Ordering System version 1.0. The flaw enables injection of malicious scripts that could be executed in the context of users interacting with the affected functionality. The CVSS 4.0 base score is 5.3, indicating a medium impact with network attack vector, low attack complexity, no privileges required, and user interaction needed.

Successful exploitation could allow attackers to execute arbitrary scripts in the context of users visiting the affected page, potentially leading to session hijacking, defacement, or other client-side attacks. However, the impact is limited by the requirement for user interaction and the absence of privilege escalation or system-level compromise. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or sanitization on the 'Name' parameter in /dbfood/contact.php to mitigate XSS risks. Monitoring vendor channels for updates is recommended.