Roskus vulnerabilities

Products

• Prospero Flow Crm 20

Newest

• roskus prospero flow crm Missing authorization in the Prospero Flow CRM user API allows a basic role user to read and delete other accounts CVE-2026-114519 8.6 HighOctober 22, 2026
• roskus prospero flow crm CSRF in Prospero Flow CRM order confirmation allows unauthorized order state changes CVE-2026-82911 5.1 MediumSeptember 4, 2026
• roskus prospero flow crm Unrestricted upload of file with dangerous type in Prospero Flow CRM product photo allows stored cross-site scripting CVE-2026-81931 4.8 MediumAugust 27, 2026
• roskus prospero flow crm IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification CVE-2026-78365 9.3 CriticalAugust 24, 2026
• roskus prospero flow crm Unrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVG CVE-2026-78337 4.8 MediumAugust 24, 2026
• roskus prospero flow crm Unvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save endpoint allow cross-tenant disclosure of banking identifiers CVE-2026-77780 5.3 MediumAugust 21, 2026
• roskus prospero flow crm IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records CVE-2026-77759 8.7 HighAugust 21, 2026
• roskus prospero flow crm Use of hard-coded credentials in Prospero Flow CRM employee onboarding CVE-2026-19871 9.3 CriticalAugust 14, 2026
• roskus prospero flow crm IDOR in Prospero Flow CRM allows cross-tenant payroll disclosure and creation CVE-2026-19870 8.6 HighAugust 14, 2026
• roskus prospero flow crm IDOR in Prospero Flow CRM allows cross-tenant product disclosure and hijacking CVE-2026-19734 8.6 HighAugust 13, 2026
• roskus prospero flow crm IDOR in Prospero Flow CRM allows cross-tenant ticket read, hijacking, and deletion CVE-2026-19539 8.6 HighAugust 11, 2026
• roskus prospero flow crm Authorization Bypass Through User-Controlled Key in Prospero Flow CRM contact save and vCard export CVE-2026-19433 8.6 HighAugust 10, 2026
• roskus prospero flow crm Missing Authorization in Prospero Flow CRM permission save endpoint allows privilege escalation CVE-2026-59233 8.7 HighAugust 10, 2026
• roskus prospero flow crm Stored Cross-site Scripting in Prospero Flow CRM lead name field CVE-2026-59232 5.3 MediumJuly 31, 2026
• roskus prospero flow crm IDOR in Prospero Flow CRM allows deletion of other users' notifications CVE-2026-59240 6.9 MediumJuly 27, 2026
• roskus prospero flow crm Stored XSS in Prospero Flow CRM email body allows administrator account takeover CVE-2026-59239 8.6 HighJuly 27, 2026
• roskus prospero flow crm IDOR in Prospero Flow CRM Order API allows cross-tenant read and modification of orders CVE-2026-59237 6.9 MediumJuly 16, 2026
• roskus prospero flow crm Authorization bypass in Prospero Flow CRM Excel import allows cross-tenant record injection CVE-2026-59236 6.9 MediumJuly 15, 2026
• roskus prospero flow crm Missing authorization in Prospero Flow CRM allows low-privileged users to read all bank accounts CVE-2026-59235 8.7 HighJuly 15, 2026
• roskus prospero flow crm Authorization Bypass Through User-Controlled Key in Prospero Flow CRM calendar event deletion CVE-2026-59234 6.9 MediumJuly 3, 2026