This vulnerability in Devs Palace ERP Online up to version 4.0.0 involves a cross-site scripting flaw in an unknown function within the /inventory/customer-save endpoint. Remote attackers can manipulate input to execute scripts in the context of the affected application. The CVSS 4.0 base score is 4.8 (medium severity), reflecting network attack vector, low attack complexity, required privileges, and user interaction. The vendor has not provided a fix or guidance, and no official remediation level is assigned.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the victim's browser when interacting with the affected endpoint. This may lead to session hijacking, defacement, or other client-side impacts. However, the vulnerability requires user interaction and some level of privileges, limiting its impact. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should apply standard XSS mitigations such as input validation and output encoding where possible. Monitor for updates from the vendor and apply patches promptly once available.