Erp Online CVE-2026-6651

No vendor-released patch identified at time of analysis. The vendor was contacted early about this disclosure but did not respond, leaving no official remediation path. Until a patch is available, implement the following compensating controls: (1) Restrict access to the Inventory Edit Item Page to a minimal set of trusted administrators and inventory managers by enforcing role-based access control (RBAC) at the application and network levels; side effect is reduced user autonomy but necessary for XSS mitigation. (2) Implement input validation and output encoding on the Item Name field by adding a Web Application Firewall (WAF) rule that blocks or escapes HTML special characters (<, >, ", ') in inventory-related HTTP requests; side effect is potential rejection of legitimate item names containing special characters (requires careful tuning). (3) Deploy Content Security Policy (CSP) headers with strict-src directives to prevent inline script execution, limiting blast radius if XSS occurs; side effect may require application code review to ensure compatibility. (4) Conduct security awareness training for users with high privileges to recognize phishing and malicious links that could deliver the XSS payload. Monitor for suspicious inventory item names or changes via audit logs. Vendor contact information and advisory references are available at https://vuldb.com/vuln/358285.