Devs Palace ERP Online EUVD-2026-28954

No vendor-released patch identified at time of analysis, as the vendor has not responded to disclosure attempts. Immediate remediation options are limited to compensating controls: (1) Restrict access to the /inventory/purchase_return_save endpoint to only the users and IP addresses that genuinely require it, using web application firewall (WAF) rules or network access controls; side effect is reduced flexibility for remote inventory management. (2) Implement strict input validation and output encoding at the web server level using ModSecurity or similar WAF rulesets with XSS-specific signatures; this may block legitimate use cases if overly aggressive. (3) Disable the purchase return functionality entirely if not in active use, eliminating the attack surface. (4) Apply HTTP security headers (Content-Security-Policy, X-Frame-Options, X-Content-Type-Options) to mitigate XSS impact even if injection occurs. (5) Monitor administrator account activity and log all interactions with the /inventory/purchase_return_save endpoint for forensic detection of attacks. Given the vendor's non-responsiveness, consider evaluating alternative ERP platforms or requesting security updates directly from the vendor with a formal deadline. Reference: https://vuldb.com/vuln/362435