This vulnerability in Devs Palace ERP Online up to version 4.0.0 involves a cross-site scripting (XSS) flaw in the /inventory/add_new_customer endpoint. The exact input vector is unspecified, but the vulnerability allows remote attackers to inject and execute arbitrary scripts in the context of the affected application. The CVSS 4.0 base score is 4.8, indicating medium severity, with network attack vector, low attack complexity, and requiring user interaction and high privileges. The vendor has not provided a patch or official remediation, and the exploit code is publicly available.

Successful exploitation of this XSS vulnerability could allow attackers to execute arbitrary scripts in the context of users interacting with the vulnerable endpoint. This may lead to session hijacking, defacement, or other script-based attacks. However, the attack requires user interaction and high privileges, which limits the impact severity. No known active exploitation has been reported.

No official patch or remediation is currently available from the vendor, and the vendor has not responded to the disclosure. Users should apply general XSS mitigations such as input validation and output encoding where possible. Monitor vendor channels for any future updates or patches addressing this vulnerability. Until a fix is released, consider restricting access to the affected functionality or applying web application firewall (WAF) rules to detect and block malicious payloads targeting this endpoint.