Devs Palace ERP Online Cross-Site Scripting Vulnerability in Inventory Edit Item Page

A cross-site scripting (XSS) vulnerability has been identified in Devs Palace ERP Online versions prior to 4.0.0. The issue arises in the Inventory Edit Item Page, where user input for the Item Name argument is not properly sanitized. This flaw allows for the injection of malicious scripts that are stored and executed in the context of other users. The vulnerability can be exploited remotely, potentially affecting multiple users over time.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of other users.