CVE-2026-8219
Cross-Site Scripting in Devs Palace ERP Online
Publication date: 2026-05-10
Last updated on: 2026-05-10
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| devs_palace | erp_online | to 4.0.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-8219 is a security vulnerability found in Devs Palace ERP Online up to version 4.0.0. It involves an unknown function in the file /inventory/supplier-save that allows for cross site scripting (XSS) attacks. This means an attacker can inject malicious scripts into the web application, which can then be executed by other users. The vulnerability can be exploited remotely, and the exploit has been publicly disclosed.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to perform cross site scripting attacks on the affected ERP system. Such attacks can lead to the execution of malicious scripts in the context of other users, potentially resulting in session hijacking, defacement, or redirection to malicious sites. Since the exploit is remotely executable and publicly disclosed, it increases the risk of attacks against vulnerable systems.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The vulnerability in Devs Palace ERP Online up to version 4.0.0 involves cross site scripting via an unknown function in the /inventory/supplier-save file. Detection would involve monitoring HTTP requests to this endpoint for suspicious input patterns that could trigger XSS.
Since the vulnerability is related to cross site scripting, you can detect attempts by inspecting web server logs or using web application firewall (WAF) rules to identify payloads containing typical XSS attack vectors such as script tags or event handlers.
Suggested commands include using tools like curl or wget to send crafted requests to the /inventory/supplier-save endpoint and observe responses for reflected scripts.
- curl -X POST -d "input=<script>alert(1)</script>" http://target/inventory/supplier-save -v
- grep -iE "<script|onerror|onload" /var/log/httpd/access_log
- Use a web vulnerability scanner configured to test for XSS on the /inventory/supplier-save endpoint.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the vulnerable endpoint /inventory/supplier-save, especially from untrusted networks.
Implement input validation and output encoding on the server side to prevent malicious scripts from being executed.
Deploy a web application firewall (WAF) with rules to block common XSS attack patterns targeting this endpoint.
Monitor logs for suspicious activity and consider disabling or limiting functionality related to supplier-save until a patch or fix is available.
Since the vendor has not responded, consider isolating the affected system or applying custom patches if possible.