Product by Roskus
Prospero Flow CRM
20 known vulnerabilities in Prospero Flow CRM (Roskus), 0 of them actively exploited (CISA KEV).
Key figures
20
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
2
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-59239 | Stored XSS in Prospero Flow CRM email body allows administrator account takeover | — | |
| Critical | CVE-2026-78365 | Roskus Prospero Flow CRM: Authorization Bypass Through User-Controlled Key | — | |
| Critical | CVE-2026-19871 | Use of hard-coded credentials in Prospero Flow CRM employee onboarding | — | |
| High | CVE-2026-59235 | Missing authorization in Prospero Flow CRM allows low-privileged users to read all bank accounts | — | |
| High | CVE-2026-19734 | IDOR in Prospero Flow CRM allows cross-tenant product disclosure and hijacking | — | |
| High | CVE-2026-77759 | Roskus Prospero Flow CRM: Authorization Bypass Through User-Controlled Key | — | |
| High | CVE-2026-114519 | Roskus Prospero Flow CRM: Missing Authorization | — | |
| High | CVE-2026-19539 | IDOR in Prospero Flow CRM allows cross-tenant ticket read, hijacking, and deletion | — | |
| High | CVE-2026-19433 | Authorization Bypass Through User-Controlled Key in Prospero Flow CRM contact save and vCard export | — | |
| High | CVE-2026-59233 | Missing Authorization in Prospero Flow CRM permission save endpoint allows privilege escalation | — | |
| Medium | CVE-2026-59237 | IDOR in Prospero Flow CRM Order API allows cross-tenant read and modification of orders | — | |
| Medium | CVE-2026-59236 | Authorization bypass in Prospero Flow CRM Excel import allows cross-tenant record injection | — | |
| Medium | CVE-2026-59234 | Authorization Bypass Through User-Controlled Key in Prospero Flow CRM calendar event deletion | — | |
| High | CVE-2026-19870 | IDOR in Prospero Flow CRM allows cross-tenant payroll disclosure and creation | — | |
| Medium | CVE-2026-59240 | IDOR in Prospero Flow CRM allows deletion of other users' notifications | — | |
| Medium | CVE-2026-59232 | Stored Cross-site Scripting in Prospero Flow CRM lead name field | — | |
| Medium | CVE-2026-81931 | Roskus Prospero Flow CRM: Unrestricted Upload of File with Dangerous Type | — | |
| Medium | CVE-2026-77780 | Roskus Prospero Flow CRM: Authorization Bypass Through User-Controlled Key | — | |
| Medium | CVE-2026-78337 | Roskus Prospero Flow CRM: Unrestricted Upload of File with Dangerous Type | — | |
| Medium | CVE-2026-82911 | CSRF in Prospero Flow CRM order confirmation allows unauthorized order state changes | — |