{"id":"CVE-2026-6651","state":"PUBLISHED","title":"erponline.xyz ERP Online Inventory Edit Item cross site scripting","description":"A security flaw has been discovered in erponline.xyz ERP Online up to 4.0.0. This vulnerability affects unknown code of the component Inventory Edit Item Page. The manipulation of the argument Item Name results in cross site scripting. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","publishedAt":"2026-04-20T14:45:11.560Z","updatedAt":"2026-04-20T15:21:57.084Z","severity":{"score":4.8,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["erponline.xyz ERP Online"],"affected":[{"vendor":"erponline.xyz","product":"ERP Online","versions":[{"version":"4.0","status":"affected"}],"modules":["Inventory Edit Item Page"]}],"references":["https://vuldb.com/vuln/358285","https://vuldb.com/vuln/358285/cti","https://vuldb.com/submit/793806","https://olografix.org/acme/ERP_Online-POC.gif"],"weaknesses":["CWE-79","CWE-94"],"ingestedAt":"2026-10-29T20:12:49.727Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/6xxx/CVE-2026-6651.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-6651","state":"PUBLISHED","datePublished":"2026-04-20T14:45:11.560Z","dateUpdated":"2026-04-20T15:21:57.084Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-04-20T05:55:13.524Z"},"containers":{"cna":{"title":"erponline.xyz ERP Online Inventory Edit Item cross site scripting","descriptions":[{"lang":"en","value":"A security flaw has been discovered in erponline.xyz ERP Online up to 4.0.0. This vulnerability affects unknown code of the component Inventory Edit Item Page. The manipulation of the argument Item Name results in cross site scripting. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"vendor":"erponline.xyz","product":"ERP Online","versions":[{"version":"4.0","status":"affected"}],"modules":["Inventory Edit Item Page"]}],"references":[{"url":"https://vuldb.com/vuln/358285","name":"VDB-358285 | erponline.xyz ERP Online Inventory Edit Item cross site scripting","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/358285/cti","name":"VDB-358285 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/793806","name":"Submit #793806 | Devs Palace ERP Online 4.0.0 Code Injection","tags":["third-party-advisory"]},{"url":"https://olografix.org/acme/ERP_Online-POC.gif","tags":["exploit"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":4.8,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":2.4,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R","baseSeverity":"LOW"}},{"cvssV3_0":{"version":"3.0","baseScore":2.4,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R","baseSeverity":"LOW"}},{"cvssV2_0":{"version":"2.0","baseScore":3.3,"vectorString":"AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","type":"CWE","lang":"en","description":"Cross Site Scripting"}]},{"descriptions":[{"cweId":"CWE-94","type":"CWE","lang":"en","description":"Code Injection"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-04-20T14:45:11.560Z"},"timeline":[{"time":"2026-04-20T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-04-20T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-04-20T09:31:35.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"Andrea Intilangelo","type":"finder"},{"lang":"en","value":"acme (VulDB User)","type":"reporter"},{"lang":"en","value":"acme (VulDB User)","type":"analyst"},{"lang":"en","value":"VulDB CNA Team","type":"coordinator"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-04-20T15:21:51.346945Z","id":"CVE-2026-6651","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-04-20T15:21:57.084Z"}}]}}}