CVE-2026-59232
Stored Cross-site Scripting in Prospero Flow CRM lead name field
- State
- Published
- Severity
- 5.3 Medium
- Published
- Jul 31, 2026
- Updated
- Jul 31, 2026
- Reserved
- Jul 3, 2026
Description
Cross-site Scripting in the lead index view in Roskus Prospero Flow CRM before 5.3.7 allows authenticated users holding the create or update lead permission to execute arbitrary JavaScript in the application origin via HTML markup stored in the lead name field, which the view renders through Blade's unescaped output directive and inside a JavaScript string literal in an onclick attribute.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N | Secur0 |
Weaknesses
- CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')
Affected Products
| Product | Versions |
|---|---|
Prospero Flow CRMRoskus |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.