This vulnerability in Devs Palace ERP Online up to version 4.0.0 involves a cross-site scripting issue in an unknown function of the /inventory/supplier-save endpoint. The flaw permits remote attackers to execute script code in the context of the affected application by manipulating input parameters. The CVSS 4.0 score is 4.8, indicating medium severity with network attack vector, low attack complexity, and requiring high privileges and user interaction. The vendor has not issued any patch or advisory, and no known exploits are reported in the wild.

Successful exploitation could allow an attacker with high privileges and user interaction to execute arbitrary scripts in the context of the ERP Online application. This may lead to session hijacking, defacement, or other client-side attacks. However, the impact is limited by the requirement for high privileges and user interaction, and no evidence of active exploitation is reported.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded or provided a fix, users should consider applying input validation or output encoding workarounds if possible. Monitor vendor channels for any future updates or patches. Avoid exposing the vulnerable endpoint to untrusted users and limit access to trusted administrators until a fix is released.