CVE-2026-8221

LowCVSS 2.4/10Last modified Jul 24, 2026

Description

A flaw has been found in Devs Palace ERP Online up to 4.0.0. This impacts an unknown function of the file /inventory/item-save. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 2.4/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

No affected versions have been published.

Timeline

Published: May 10, 2026
Last modified: Jul 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-82210Enforceable assertion in the streaming feature of Apache bRPC (version < 1.18.0) on all platforms allows a remote attacker to crash the serv CVE-2026-822118.2The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its unauthenticated routes, all CVE-2026-822127.5The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate the security token on its payment notification route, accepti CVE-2026-822135.3The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current CVE-2026-822155.9The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications CVE-2026-822178.8In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools (writeFileContent, suggestFileContent CVE-2026-82227.5A vulnerability has been found in Open5GS up to 2.7.7. Affected is the function pcf_nbsf_management_handle_register of the file src/pcf/nbsf CVE-2026-822205.3Unauthenticated Other Vulnerability Type in Forminator <= 1.57.1 versions.CVE-2026-822217.1Unauthenticated Cross Site Scripting (XSS) in RegistrationMagic <= 6.0.9.8 versions.CVE-2026-8222210.0Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP GiveWP allows Object Injection. This issue affects GiveWP: from n CVE-2026-822236.5Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.22 versions.CVE-2026-822247.1Unauthenticated Cross Site Scripting (XSS) in SliceWP <= 1.2.10 versions.