CVE-2026-82911 | | | 2026-09-04 | Cross-Site Request Forgery (CSRF) in the OrderConfirmController at GET /order/confirm/{order_number} in Roskus Prospero Flow CRM before 5.15.11 allows an unaut… |
CVE-2026-81931 | | | 2026-08-27 | Unrestricted Upload of File with Dangerous Type in the product photo upload in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated user holding the… |
CVE-2026-78365 | | | 2026-08-24 | Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and… |
CVE-2026-78337 | | | 2026-08-24 | Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the… |
CVE-2026-77780 | | | 2026-08-21 | Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus
Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transacti… |
CVE-2026-77759 | | | 2026-08-21 | Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero
Flow CRM 5.0.0 through 5.3.5 allows an authenticated user to read th… |
CVE-2026-19871 | | | 2026-08-14 | Use of Hard-coded Credentials in the human resources component in Roskus Prospero Flow CRM before 5.15.9 allows unauthenticated remote attackers to authenticat… |
CVE-2026-19870 | | | 2026-08-14 | Authorization Bypass Through User-Controlled Key in the payroll module in Roskus Prospero Flow CRM before 5.15.10 allows authenticated users holding the read p… |
CVE-2026-19734 | | | 2026-08-13 | Missing Authorization and Authorization Bypass Through User-Controlled Key in the product management component in Roskus Prospero Flow CRM before 5.4.7 allows… |
CVE-2026-19539 | | | 2026-08-11 | Authorization Bypass Through User-Controlled Key in the ticket management component in Roskus Prospero Flow CRM before 5.4.9 allows authenticated users of any… |
CVE-2026-19433 | | | 2026-08-10 | Authorization Bypass Through User-Controlled Key in the contact management component in Roskus Prospero Flow CRM before 5.4.8 allows authenticated users of any… |
CVE-2026-59233 | | | 2026-08-10 | Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, includin… |
CVE-2026-59232 | | | 2026-07-31 | Cross-site Scripting in the lead index view in Roskus Prospero Flow CRM before 5.3.7 allows authenticated users holding the create or update lead permission to… |
CVE-2026-59240 | | | 2026-07-27 | The vulnerability involves an Insecure Direct Object Reference (IDOR) in the `DeleteNotificationController::delete()` method at endpoint `GET /notification/del… |
CVE-2026-59239 | | | 2026-07-27 | Stored Cross-site Scripting (CWE-79) in the email module in Roskus Prospero Flow CRM before 5.4.4 allows a remote, authenticated low-privileged user to execute… |
CVE-2026-59237 | | | 2026-07-16 | Authorization Bypass Through User-Controlled Key (CWE-639) in the Order and OrderItem REST API controllers in Roskus Prospero Flow CRM before 5.5.3 allows a re… |
CVE-2026-59236 | | | 2026-07-15 | Authorization Bypass Through User-Controlled Key (CWE-639) in the Excel import handlers (CustomerImport, LeadImport, ProductImport) in Roskus Prospero Flow CRM… |
CVE-2026-59235 | | | 2026-07-15 | Missing Authorization (CWE-862) in BankAccountListController (app/Http/Controllers/Api/BankAccount/BankAccountListController.php), exposed at GET /api/bank-acc… |
CVE-2026-59234 | | | 2026-07-03 | Authorization Bypass Through User-Controlled Key (CWE-639) in CalendarDeleteEventController (app/Http/Controllers/Calendar/CalendarDeleteEventController.php)… |