CVE-2026-8253
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A cross-site scripting vulnerability was identified in Devs Palace ERP Online up to version 4.0.0 in the file /inventory/purchase_save. The attack can be initiated remotely and the exploit is publicly available.
Risk Assessment
An attacker can inject malicious scripts, potentially leading to session hijacking or website defacement.
Recommendation
Immediately update the system to the latest version or apply a vendor patch. If not possible, restrict access to the /inventory/purchase_save file.
Original NVD description (English source)
A vulnerability was identified in Devs Palace ERP Online up to 4.0.0. Affected by this vulnerability is an unknown functionality of the file /inventory/purchase_save. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.