This vulnerability in Devs Palace ERP Online up to version 4.0.0 allows remote attackers to perform cross-site scripting (XSS) attacks by manipulating input in the /inventory/add_new_customer endpoint. The exact nature of the input vector is unspecified. The vulnerability has a CVSS 4.8 score, indicating medium severity, with an attack vector of network and low attack complexity. The vendor has not provided a patch or mitigation, and the exploit is publicly available.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other client-side impacts. However, the CVSS vector indicates no privilege escalation or confidentiality/integrity/availability impact beyond the XSS itself. The vulnerability requires user interaction and some privileges, limiting the scope of impact.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded and no fixes are published, users should consider applying web application firewalls or input validation controls as temporary mitigations. Monitor vendor channels for any future advisories or patches. Avoid interacting with untrusted input in the affected endpoint where possible.