This issue arises from a vulnerable function in the /inventory/customer-save endpoint of Devs Palace ERP Online, allowing an attacker to inject malicious scripts that are reflected back to the user’s browser. The vulnerability can be triggered remotely and is publicly available for exploitation. The potential consequences include arbitrary script execution in the context of the victim’s browser, which may lead to session hijacking, data theft, or defacement. The weakness aligns with CWE-79 (Cross‐Site Scripting) and CWE-94 (Code Injection), indicating user input is not properly sanitized or encoded before use.

Devs Palace ERP Online versions up to 4.0.0 are affected. The specific function that is vulnerable resides in the /inventory/customer-save route, but no further version granularity is provided.

The CVSS score of 4.8 indicates a low severity issue, and the EPSS score is unavailable, suggesting limited evidence of active exploitation. The vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires an attacker to send a crafted request to the /inventory/customer-save endpoint, which can be performed remotely via an HTTP request. Without input validation, the payload is reflected and executed in the user’s browser. The lack of an immediate remedy from the vendor increases the risk of continued exploitation until a patch or mitigation is applied.