CVE-2026-8219
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
In Devs Palace ERP Online up to version 4.0.0, an unknown function in the file /inventory/supplier-save is vulnerable to Cross Site Scripting (XSS). The attack can be performed remotely, and the exploit has been publicly disclosed. The vendor did not respond to the disclosure.
Risk Assessment
The organization is exposed to XSS attacks that could lead to session theft, redirection to malicious sites, or theft of user data within the ERP system.
Recommendation
Immediately apply available patches or temporarily disable the /inventory/supplier-save function if possible, and monitor for updates from the vendor.
Original NVD description (English source)
A security vulnerability has been detected in Devs Palace ERP Online up to 4.0.0. The impacted element is an unknown function of the file /inventory/supplier-save. The manipulation leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.