What’s Vulnerable › Products
Roskus Prospero Flow CRM vulnerabilities
20 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 20 published in the last 12 months.
Check whether your Roskus Prospero Flow CRM version is affected
Latest Roskus Prospero Flow CRM vulnerabilities
- CVE-2026-114519 — Missing authorization in the Prospero Flow CRM user API allows a basic role user to read and delete other accounts (CVSS 8.6)
- CVE-2026-82911 — CSRF in Prospero Flow CRM order confirmation allows unauthorized order state changes (CVSS 5.1)
- CVE-2026-81931 — Unrestricted upload of file with dangerous type in Prospero Flow CRM product photo allows stored cross-site scripting (CVSS 4.8)
- CVE-2026-78365 — IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification (CVSS 9.3)
- CVE-2026-78337 — Unrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVG (CVSS 4.8)
- CVE-2026-77780 — Unvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save endpoint allow cross-tenant disclosure of banking identifiers (CVSS 5.3)
- CVE-2026-77759 — IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records (CVSS 8.7)
- CVE-2026-19871 — Use of hard-coded credentials in Prospero Flow CRM employee onboarding (CVSS 9.3)
- CVE-2026-19870 — IDOR in Prospero Flow CRM allows cross-tenant payroll disclosure and creation (CVSS 8.6)
- CVE-2026-19734 — IDOR in Prospero Flow CRM allows cross-tenant product disclosure and hijacking (CVSS 8.6)
- CVE-2026-19539 — IDOR in Prospero Flow CRM allows cross-tenant ticket read, hijacking, and deletion (CVSS 8.6)
- CVE-2026-19433 — Authorization Bypass Through User-Controlled Key in Prospero Flow CRM contact save and vCard export (CVSS 8.6)
- CVE-2026-59233 — Missing Authorization in Prospero Flow CRM permission save endpoint allows privilege escalation (CVSS 8.7)
- CVE-2026-59232 — Stored Cross-site Scripting in Prospero Flow CRM lead name field (CVSS 5.3)
- CVE-2026-59240 — IDOR in Prospero Flow CRM allows deletion of other users' notifications (CVSS 6.9)
- CVE-2026-59239 — Stored XSS in Prospero Flow CRM email body allows administrator account takeover (CVSS 8.6)
- CVE-2026-59237 — IDOR in Prospero Flow CRM Order API allows cross-tenant read and modification of orders (CVSS 6.9)
- CVE-2026-59236 — Authorization bypass in Prospero Flow CRM Excel import allows cross-tenant record injection (CVSS 6.9)
- CVE-2026-59235 — Missing authorization in Prospero Flow CRM allows low-privileged users to read all bank accounts (CVSS 8.7)
- CVE-2026-59234 — Authorization Bypass Through User-Controlled Key in Prospero Flow CRM calendar event deletion (CVSS 6.9)