PT-2026-66780 · Roskus · Prospero Flow Crm

Gustavo Novaro + 2 · CVE-2026-59232 · Publicado 2026-07-31 · Atualizado 2026-07-31

NVD

CVSS v4.0

5.3

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Cross-site Scripting in the lead index view in Roskus Prospero Flow CRM before 5.3.7 allows authenticated users holding the create or update lead permission to execute arbitrary JavaScript in the application origin via HTML markup stored in the lead name field, which the view renders through Blade's unescaped output directive and inside a JavaScript string literal in an onclick attribute.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-59232

Produtos afetados

Prospero Flow Crm

Referências · 4

• https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3 · Nota
• https://github.com/Roskus/prospero-flow-crm/commit/8b2633ddb2178c2f79718efdfb906e051ba2f03c · Correção
• https://secur0.com/en/cna/cve-list/cve-2026-59232-stored-xss-in-prospero-flow-crm-lead-name-field · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-59232 · Nota de Segurança