Unknown · Devs Palace Erp Online · CVE-2026-8218
**Name of the Vulnerable Software and Affected Versions**
Devs Palace ERP Online versions prior to 4.0.0
**Description**
A weakness in an unknown function within the '/inventory/purchase return save' file allows for remote cross-site scripting (XSS), a technique where malicious scripts are injected into trusted websites.
**Recommendations**
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
As a temporary workaround, restrict access to the '/inventory/purchase return save' file to minimize the risk of exploitation.