This vulnerability (CVE-2024-10539) in Uyumsoft ERP is a reflected XSS issue caused by improper input sanitization during web page generation. Attackers can exploit this by injecting malicious scripts using invalid characters, which are then reflected back to users. The affected versions are those before Erp4.2109.166p45. The CVSS 3.1 base score is 5.5, indicating medium severity, with attack vector network, low attack complexity, requiring low privileges and user interaction, and impacts on confidentiality, integrity, and availability rated as low.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected user's browser session, potentially leading to limited disclosure of information, manipulation of web content, or disruption of service. However, the impact is rated as low on confidentiality, integrity, and availability, and no known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with untrusted input and consider implementing web application firewall (WAF) rules to detect and block reflected XSS attempts. Monitor vendor channels for updates regarding patches or official mitigations.