This vulnerability involves a cross-site scripting flaw in Devs Palace ERP Online up to version 4.0.0, specifically in an unknown function of the /inventory/purchase_return_save endpoint. An attacker can remotely execute a manipulation that leads to XSS, potentially allowing execution of malicious scripts in the context of a victim's browser. The CVSS 4.0 base score is 4.8 (medium), reflecting network attack vector, low attack complexity, no privileges required, but user interaction is needed. The vendor has not issued a fix or advisory, and no patch links are available.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of users interacting with the vulnerable endpoint, which could lead to session hijacking, defacement, or other client-side impacts. However, the vulnerability requires user interaction and no privilege escalation or direct system compromise is indicated. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, organizations should consider applying web application firewall (WAF) rules to detect and block XSS payloads targeting the /inventory/purchase_return_save endpoint. Additionally, review and sanitize user inputs on this endpoint as a temporary mitigation until an official patch is released.