CVE-2026-59232

UNKNOWN 0.0

Stored Cross-site Scripting in Prospero Flow CRM lead name field

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Cross-site Scripting in the lead index view in Roskus Prospero Flow CRM before 5.3.7 allows authenticated users holding the create or update lead permission to execute arbitrary JavaScript in the application origin via HTML markup stored in the lead name field, which the view renders through Blade's unescaped output directive and inside a JavaScript string literal in an onclick attribute.

CWE	CWE-79
Vendor	roskus
Product	prospero flow crm
Published	Jul 31, 2026

Stay Ahead of the Next One

Get instant alerts for roskus prospero flow crm

Be the first to know when new unknown vulnerabilities affecting roskus prospero flow crm are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Roskus / Prospero Flow CRM

0 < 5.3.7

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Roskus/prospero-flow-crm/commit/8b2633ddb2178c2f79718efdfb906e051ba2f03c github.com: https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3 secur0.com: https://secur0.com/en/cna/cve-list/cve-2026-59232-stored-xss-in-prospero-flow-crm-lead-name-field

Credits

k1di3 Cristian Fernández Cornejo Xoán M. Otero Jorge Secur0 CNA Gustavo Novaro