This vulnerability in Devs Palace ERP Online up to version 4.0.0 involves a cross-site scripting (XSS) flaw in the /accounts/mr-save file. The vulnerability allows remote attackers to inject malicious scripts, potentially impacting users who interact with the affected functionality. The vendor was notified but has not issued any response or patch. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required but user interaction is needed, and limited impact on integrity and availability.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking or other client-side impacts. However, the impact is limited by the need for user interaction and the absence of privilege escalation or system-level compromise. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should consider applying input validation or output encoding workarounds if possible, and exercise caution with untrusted input in the affected functionality. Monitor for vendor updates regarding an official fix.