CVE-2026-59232 - Stored Cross-site Scripting in Prospero Flow CRM lead name field

Back Back to CVE browser

MEDIUM

Stored Cross-site Scripting in Prospero Flow CRM lead name field

Published Jul 31, 2026

5.3

MEDIUM

CVSS 4.0

EPSS 0.53%

Description

Cross-site Scripting in the lead index view in Roskus Prospero Flow CRM before 5.3.7 allows authenticated users holding the create or update lead permission to execute arbitrary JavaScript in the application origin via HTML markup stored in the lead name field, which the view renders through Blade's unescaped output directive and inside a JavaScript string literal in an onclick attribute.

Affected products

Vendor Roskus Product Prospero Flow CRM Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <5.3.7

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Roskus

Prospero Flow CRM

unaffected

Version	Status	Constraints
0	affected	<5.3.7

Remediation

Vendor solution

Upgrade to version 5.3.7 or higher. The fix was not tagged: the earliest tagged release containing it is v5.5.3.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://github.com/Roskus/prospero-flow-crm/commit/8b2633ddb2178c2f79718efdfb906e051ba2f03c
patch
https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3
release-notes
https://secur0.com/en/cna/cve-list/cve-2026-59232-stored-xss-in-prospero-flow-crm-lead-name-field
technical-description

Link	Providers	Tags
https://github.com/Roskus/prospero-flow-crm/commit/8b2633ddb2178c2f79718efdfb906e051ba2f03c		patch
https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3		release-notes
https://secur0.com/en/cna/cve-list/cve-2026-59232-stored-xss-in-prospero-flow-crm-lead-name-field		technical-description