This vulnerability involves a cross-site scripting flaw in Devs Palace ERP Online up to version 4.0.0, specifically in an unknown function of the /inventory/supplier-save endpoint. The flaw allows remote attackers to inject malicious scripts that execute in the context of the victim's browser. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and low impact on integrity and availability. The vendor has not issued any patch or official fix, and the vulnerability was disclosed publicly without vendor response.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of a victim's browser session, potentially leading to session hijacking, information disclosure, or other client-side impacts. However, the CVSS score of 4.8 and vector indicate limited impact, requiring user interaction and some privileges, with no direct impact on confidentiality or availability.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded and no fix is provided, users should apply standard XSS mitigations such as input validation and output encoding where possible. Monitor for updates from the vendor for any future patches. Consider restricting access to the affected endpoint or applying web application firewall (WAF) rules to detect and block malicious input targeting /inventory/supplier-save.