MEDIUM
Devs Palace ERP Online chart-save cross site scripting
Published May 11, 2026
4.8
MEDIUMCVSS 4.0
EPSS 0.35%
Description
A vulnerability was identified in Devs Palace ERP Online up to 4.0.0. This impacts an unknown function of the file /accounts/chart-save. Such manipulation leads to cross site scripting. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products
-
- Version 4.0StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Devs Palace | ERP Online | n/a |
|
No data.
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (2)
References (5)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-29018 Advisory
- https://olografix.org/acme/_poc/ERP_Online-POC1.gif exploit
- https://vuldb.com/submit/809930 third-party-advisory
- https://vuldb.com/vuln/362559 vdb-entry
- https://vuldb.com/vuln/362559/cti signaturepermissions-required
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-29018 | Advisory | |
| https://olografix.org/acme/_poc/ERP_Online-POC1.gif | exploit | |
| https://vuldb.com/submit/809930 | third-party-advisory | |
| https://vuldb.com/vuln/362559 | vdb-entry | |
| https://vuldb.com/vuln/362559/cti | signaturepermissions-required |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner VulDB
Published May 11, 2026
Updated May 11, 2026
Reserved May 10, 2026
Link CVE-2026-8262
CISA Vulnrichment
Updated May 11, 2026
ENISA EUVD
EUVD-2026-29018 Assigner VulDB
Published May 11, 2026
Updated May 11, 2026
Exploited since n/a
Link EUVD-2026-29018