A reflected cross‑site scripting flaw was identified in the Inventory Edit Item Page of erponline.xyz ERP Online, exploitable via manipulation of the "Item Name" field. The vulnerability allows an attacker to inject arbitrary client‑side scripts into a victim’s browser session. An attacker can use the publicly available exploit, and the vulnerability can be triggered remotely through the web interface.

The flaw exists in all releases of erponline.xyz ERP Online up to and including version 4.0.0. The specific component affected is the code handling the Inventory Edit Item Page. No later versions were listed in the provided data.

The CVSS score of 4.8 indicates a moderate impact; the EPSS score is not available, so the exact exploitation likelihood cannot be quantified. The vulnerability is not listed in CISA KEV, but the vendor’s lack of response and the public release of exploit code increase the urgency. An attacker only needs to send a crafted web request to a victim with access to the edit form; no local privilege escalation or authentication bypass is required by the information provided.