This vulnerability involves a cross-site scripting flaw in Devs Palace ERP Online up to version 4.0.0. The issue resides in an unspecified functionality within the /inventory/sales_save endpoint, allowing remote attackers to inject malicious scripts. The vulnerability requires no privileges and no user interaction, but the attack complexity is low and the impact on confidentiality and availability is minimal. The vendor has not provided a patch or remediation guidance, and the exploit is publicly available.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other client-side attacks. However, the impact on confidentiality and availability is low, and the overall severity is medium. There is no indication of privilege escalation or direct system compromise.

Patch status is not yet confirmed — no official fix or remediation guidance is available from the vendor. Users should monitor the vendor's communications for updates. Until a patch is released, consider applying input validation or web application firewall (WAF) rules to detect and block malicious input targeting the /inventory/sales_save endpoint.