The flaw is a remote cross‑site scripting (XSS) vulnerability found in Devs Palace ERP Online's /inventory/sales_save endpoint. Attackers can inject arbitrary JavaScript by manipulating this functionality. The resulting execution runs in the victim’s browser with the context of the ERP, which can be used to steal session cookies, hijack accounts, deface pages, or deliver malware. The CVE description notes that the exploit has been publicly released and can be launched remotely.

The affected product is Devs Palace ERP Online, versions up to and including 4.0.0. All releases before the fix contain the vulnerable sales_save code. No sub‑version details were supplied, so any deployment of 4.0.0 or earlier is potentially exposed.

The CVSS score of 4.8 places the issue in the moderate severity range. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the attacker’s vector is remote via a crafted request to the sales_save page. Since the flaw permits the injection of arbitrary client‑side scripts, the risk to confidentiality, integrity, and availability is significant if an attacker successfully deceives an authenticated stakeholder into loading a malicious page.