This vulnerability in Devs Palace ERP Online up to version 4.0.0 involves a cross-site scripting flaw in an unknown function of the /inventory/customer-save endpoint. The vulnerability can be triggered remotely without authentication, allowing an attacker to inject malicious scripts. The vendor has not issued any advisory or fix, and no official remediation is currently available. The CVSS 4.0 base score is 4.8, indicating medium severity with network attack vector, low attack complexity, and requiring high privileges and user interaction.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other client-side impacts. However, the attack requires high privileges and user interaction, which limits the scope of impact. There is no indication of data confidentiality or integrity compromise beyond the XSS impact.

No official patch or remediation is currently available from the vendor. Users of Devs Palace ERP Online version 4.0.0 and earlier should consider implementing application-layer protections such as input validation and output encoding on the /inventory/customer-save endpoint. Monitoring for suspicious activity related to this endpoint is advised. Check regularly for vendor updates or advisories for any forthcoming fixes.