A flaw in Devs Palace ERP Online allows an attacker to inject malicious script into an untrusted page, enabling the execution of arbitrary JavaScript on the browser of anyone who views that page. The vulnerability resides in an unspecified portion of the /inventory/add_new_customer endpoint and can be triggered remotely by submitting crafted input. Successful exploitation permits attackers to hijack user accounts, steal session data, or perform phishing actions that appear legitimate to the affected user.

The issue affects Devs Palace ERP Online versions up to and including 4.0.0. The vulnerability applies to an undefined part of the /inventory/add_new_customer endpoint within these releases. No specific sub‑components or modules are named beyond the mentioned endpoint.

An exploit has been publicly released and can be launched remotely without authentication. The CVSS score of 4.8 indicates moderate severity; the EPSS score is not available, making it difficult to gauge current exploitation prevalence. The vulnerability is not listed in the CISA KEV catalog, and no widespread exploitation has been reported. Nonetheless, the remote nature of the attack and the ability to execute arbitrary client‑side code warrant immediate remediation.