A vulnerability in the /inventory/purchase_save functionality of Devs Palace ERP Online allows an attacker to inject arbitrary client‑side scripts. The flaw is a classic reflected or stored cross‑site scripting (CWE‑79) and may also involve unsanitized code evaluation (CWE‑94). An attacker can remotely supply input that is later rendered by the application, enabling the execution of arbitrary JavaScript in the context of the victim’s browser. The impact is primarily the theft of credentials, session hijacking, or the delivery of malicious payloads to end‑users. The vendor’s description confirms that the exploit is available publicly and can be triggered remotely.

The affected product is Devs Palace ERP Online, versions up to 4.0.0. No specific sub‑versions are listed, but all deployments of the 4.0.0 and earlier releases that include the /inventory/purchase_save endpoint are potentially vulnerable. The vendor has not provided an explicit revision to mitigate the issue, and no additional version data is available.

The CVSS score of 4.8 indicates a moderate impact with limited scope. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that large‑scale exploitation is not currently evident. However, the publicly available exploit and the remote nature of the attack vector imply that any exposed instance could be triggered from the internet. Overall, the risk is moderate, warranting prompt mitigation even if the likelihood of widespread use remains uncertain.