CVE-2026-59232— Stored Cross-site Scripting in Prospero Flow CRM lead name field
Possible ATT&CK Techniques 1AI
T1189 · Drive-by CompromiseAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Roskus | Prospero Flow CRM | < 5.3.7 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-59232
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Stored Cross-site Scripting in Prospero Flow CRM lead name field
Source: CVE Program / CVE List V5
Vulnerability Description
Cross-site Scripting in the lead index view in Roskus Prospero Flow CRM before 5.3.7 allows authenticated users holding the create or update lead permission to execute arbitrary JavaScript in the application origin via HTML markup stored in the lead name field, which the view renders through Blade's unescaped output directive and inside a JavaScript string literal in an onclick attribute.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
Roskus Prospero Flow CRM 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
roskus Prospero Flow CRM是roskus组织开源的一款基于 Laravel 13 构建的开源、多语言、多公司（白标）客户管理系统（CRM），支持 Docker 一键部署和 REST API 集成。 Roskus Prospero Flow CRM 5.3.7之前版本存在跨站脚本漏洞，该漏洞源于lead name字段中的HTML标记经Blade未转义输出并渲染至onclick属性中的JavaScript字符串，可能导致具有创建或更新lead权限的已认证用户执行任意JavaScript。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Roskus | Prospero Flow CRM | 0 ~ 5.3.7 | - |
II. Public POCs for CVE-2026-59232
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-59232
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-59232 (2)
Vendor Advisories for CVE-2026-59232 (1)
IV. Related Vulnerabilities
Same product: Prospero Flow CRM
- CVE-2026-59240
IDOR in Prospero Flow CRM allows deletion of other users' no - CVE-2026-59239
Stored XSS in Prospero Flow CRM email body allows administra - CVE-2026-59237
IDOR in Prospero Flow CRM Order API allows cross-tenant read - CVE-2026-59236
Authorization bypass in Prospero Flow CRM Excel import allow - CVE-2026-59235
Missing authorization in Prospero Flow CRM allows low-privil
Same vendor: Roskus
- CVE-2026-59240
IDOR in Prospero Flow CRM allows deletion of other users' no - CVE-2026-59239
Stored XSS in Prospero Flow CRM email body allows administra - CVE-2026-59237
IDOR in Prospero Flow CRM Order API allows cross-tenant read - CVE-2026-59236
Authorization bypass in Prospero Flow CRM Excel import allow - CVE-2026-59235
Missing authorization in Prospero Flow CRM allows low-privil
Same weakness: CWE-79
- CVE-2026-67617
Microweber CMS 2.0.20 Stored XSS via tag_names Parameter - CVE-2026-18682
OpenAkita File Upload API upload cross site scripting - CVE-2026-49132
OPNsense < 26.1.9 Stored XSS via Certificate Description Fie - CVE-2026-49131
OPNsense < 26.1.9 Stored XSS via Firewall Rule Description F - CVE-2026-66296
Reflected XSS in oaskit's default HTML error handler
V. Comments for CVE-2026-59232
No comments yet