This vulnerability in Devs Palace ERP Online up to version 4.0.0 allows remote attackers to perform cross-site scripting via manipulation of code in the /accounts/mr-save file. The vulnerability enables injection of malicious scripts that could be executed in the context of a user's browser session. The CVSS 4.0 base score is 4.8, indicating medium severity with network attack vector, low attack complexity, and requiring user interaction and high privileges. No official fix or patch has been released, and the vendor has not responded to the disclosure.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of a logged-in user's browser session, potentially leading to session hijacking or other client-side impacts. However, exploitation requires high privileges and user interaction, which limits the overall impact severity. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider applying workarounds such as input validation or disabling vulnerable functionality if possible. Monitor for updates from the vendor regarding patches or official mitigations.