Threats tagged 'ghsa-pcm6-qc55-rgw2'

A cross-site scripting (XSS) vulnerability exists in Devs Palace ERP Online versions up to 4.0.0 in the /inventory/sales_save functionality. This flaw allows remote attackers to inject malicious scripts. The vulnerability has a low CVSS score of 2.4 and requires high privileges and user interaction to exploit. Public exploit code is available, but no vendor response or patch has been provided.