This vulnerability involves a cross-site scripting flaw in Devs Palace ERP Online up to version 4.0.0. The issue is located in an unknown function of the /inventory/item-save endpoint, allowing remote attackers to inject malicious scripts. The CVSS 4.0 base score is 4.8, indicating medium severity with network attack vector, low attack complexity, and no privileges required for exploitation. The vendor has not provided a fix or acknowledged the issue, and no patch links or remediation details are available.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other client-side attacks. However, the impact is limited by the medium severity score and the requirement for user interaction (UI:P). There is no indication of privilege escalation or direct impact on data confidentiality or integrity beyond the XSS context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing web application firewalls (WAF) or input validation controls as temporary mitigations to reduce the risk of XSS attacks. Monitor for updates from the vendor regarding patches or official mitigations.