This vulnerability in Devs Palace ERP Online up to version 4.0.0 allows remote attackers to perform cross-site scripting attacks via an unknown function in the /accounts/chart-save endpoint. The vulnerability enables injection of malicious scripts that could be executed in the context of a victim's browser. The CVSS 4.0 base score is 4.8, reflecting medium severity with network attack vector, low attack complexity, and no privileges required but user interaction needed. There is no official patch or remediation level provided by the vendor, and the exploit is publicly available.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other client-side impacts. However, the impact is limited by the need for user interaction and the lack of privilege escalation or confidentiality/integrity/availability impacts. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing web application firewalls or input validation controls as temporary mitigations. Monitor for updates from the vendor regarding patches or official mitigations.