CVE-2026-8218
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
Devs Palace ERP Online up to version 4.0.0 is vulnerable to Cross-Site Scripting (XSS) in an unknown function of the file /inventory/purchase_return_save. The attack can be launched remotely and the exploit is public.
Risk Assessment
An attacker can inject malicious scripts that execute in the victim's browser, leading to session theft, redirects, or data theft.
Recommendation
Contact the vendor for a patch or consider using a Web Application Firewall (WAF) to block input manipulation.
Original NVD description (English source)
A weakness has been identified in Devs Palace ERP Online up to 4.0.0. The affected element is an unknown function of the file /inventory/purchase_return_save. Executing a manipulation can lead to cross site scripting. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.