This vulnerability involves a cross-site scripting flaw in Devs Palace ERP Online up to version 4.0.0, specifically in some unknown functionality within the /inventory/sales_save endpoint. An attacker can remotely manipulate input to execute script code in the context of a victim's browser. The CVSS 4.0 base score is 4.8, reflecting medium severity, with attack vector network, low attack complexity, no privileges required, and user interaction needed. The vendor was notified but has not issued a fix or advisory. No patch or mitigation guidance is currently available from the vendor.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of a user's browser session, potentially leading to session hijacking, defacement, or other client-side impacts. The vulnerability does not directly compromise system confidentiality, integrity, or availability. The exploit requires user interaction and some privileges, limiting the scope somewhat. Public exploit code availability increases the likelihood of exploitation attempts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should apply standard XSS mitigations such as input validation and output encoding where possible. Restricting access to the affected functionality and monitoring for suspicious activity may help reduce risk until an official fix is released.