A flaw in Devs Palace ERP Online up to version 4.0.0 allows an attacker to inject arbitrary client‑side scripts through the /inventory/item-save function. The resulting cross‑site scripting can lead to session hijacking, defacement, credential theft, or the execution of further malicious actions within the victim’s browser context. The vulnerability directly compromises the confidentiality and integrity of data processed by the affected function and can affect all users who interact with the application.

The vulnerability is present in Devs Palace ERP Online software versions up to and including 4.0.0. It impacts an unnamed function within the /inventory/item-save file and is relevant to installations of the ERP Online product provided by Devs Palace.

The CVSS score of 4.8 indicates a medium severity, and while the EPSS score is not published, the exploit is publicly available and can be carried out remotely. The attack vector is inferred to be remote input manipulation, wherein an attacker submits a crafted payload that is rendered by the affected endpoint. Because the vulnerability is not listed in CISA’s KEV catalog and no official patch is currently disclosed, the risk largely depends on the ability of an attacker to reach the endpoint and the robustness of any mitigating controls in place.