This vulnerability in Devs Palace ERP Online up to version 4.0.0 involves a cross-site scripting issue in an unspecified functionality within the /inventory/purchase_save endpoint. The vulnerability can be triggered remotely without user interaction, but requires high privileges and user interaction according to the CVSS vector. The vendor has not provided any response or patch, and no official remediation guidance is available.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other client-side attacks. The CVSS vector indicates that the attack requires high privileges and user interaction, which limits the ease of exploitation. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider applying web application firewall (WAF) rules to detect and block XSS attempts targeting the /inventory/purchase_save endpoint and limit access to this functionality to trusted users only.