CVE-2026-8256

LowCVSS 2.4/10Last modified Jul 24, 2026

Description

A security vulnerability has been detected in Devs Palace ERP Online up to 4.0.0. This vulnerability affects unknown code of the file /accounts/mr-save. Such manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 2.4/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-79CWE-94

Affected software

No affected versions have been published.

Timeline

Published
May 11, 2026
Last modified
Jul 24, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-825607.5Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to CVE-2026-825616.5Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entire contents of a Process Group using a client-supplied flow dCVE-2026-825623.7### Summary When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push kCVE-2026-825637.6An attacker could impersonate the camera and place themselves in a man-in-the-middle or device-emulation position. This permits manipulationCVE-2026-825647.1Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_ai allows a caller of an identity-configured tool to updatCVE-2026-825668.8The Botslab G980H dash camera firmware contains a session management vulnerability in which authentication state can remain valid after the CVE-2026-825676.3The myPRO Manager notification gateway exposes an unauthenticated HTTP endpoint used to send SMS messages through a connected GSM modem. TheCVE-2026-82575.5A vulnerability was detected in WebAssembly Binaryen up to 117. This issue affects the function IRBuilder::makeBrOn of the file src/wasm/wasCVE-2026-825787.5When XML batch processing is turned on and the XPath option is selected, the raw batch input goes through a default XPath/JAXP setup with noCVE-2026-825796.0Loop with Unreachable Exit Condition (Infinite Loop) vulnerability in ash-project ash_ai allows an attacker who can influence a model's outpCVE-2026-82585.3A flaw has been found in Squirrel up to 3.2. Impacted is the function validate_format in the library sqstdlib/sqstdstring.cpp. Executing a mCVE-2026-825805.3Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai discloses internal error text to chat users