This vulnerability in Devs Palace ERP Online up to version 4.0.0 allows remote attackers to perform cross-site scripting attacks by manipulating an unknown function in the /accounts/chart-save endpoint. The vulnerability enables injection of malicious scripts that could be executed in the context of authenticated users. The CVSS 4.0 base score is 4.8 (medium), reflecting network attack vector, low attack complexity, no privileges required, and partial impact on integrity and availability. The vendor has not provided any patch or remediation information, and the product is not a cloud service, so remediation depends on vendor action or user mitigation.

Successful exploitation of this vulnerability could allow attackers to execute arbitrary scripts in the context of authenticated users, potentially leading to session hijacking, unauthorized actions, or data manipulation within the ERP system. However, the impact is limited to the scope of the XSS and does not directly affect confidentiality or availability beyond partial integrity and availability impact as per CVSS. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing web application firewall (WAF) rules to detect and block XSS payloads targeting the /accounts/chart-save endpoint. Additionally, applying input validation and output encoding on the affected endpoint if possible, or restricting access to trusted users, may reduce risk until an official fix is released.