Executive brief
Devs Palace ERP Online, a business management platform, contains a security flaw that allows for cross-site scripting (XSS). An attacker could exploit this to execute malicious scripts in the browser of an authorized user, potentially leading to unauthorized actions or data manipulation within the ERP system. While the risk is mitigated by the requirement for high-level administrative privileges, the vulnerability remains unpatched as the vendor has not responded to disclosure attempts.
Technical details
A cross-site scripting (XSS) vulnerability exists in Devs Palace ERP Online versions up to 4.0.0. The flaw is located within the /accounts/mr-save endpoint due to improper neutralization of user-supplied input (CWE-79). An attacker with high-level privileges (PR:H) can exploit this vulnerability remotely by submitting crafted data that is subsequently executed as JavaScript in the victim's browser. Although the vendor was notified, no patch has been released, and a public exploit (PoC) is currently available. The vulnerability also carries implications of code injection (CWE-94).
Affected products
- Devs Palace ERP Online up to 4.0.0
Timeline
- 2026-05-11: advisory: NVD publication date
- 2026-05-11: disclosed: Public disclosure of the exploit
