Roskus Prospero Flow Crm
13 CVEs affecting Roskus Prospero Flow Crm. Latest disclosed: 2026-08-14. Critical: 0, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-19871 | | 2026-08-14 | Use of Hard-coded Credentials in the human resources component in Roskus Prospero Flow CRM before 5.15.9 allows unauthenticated remote attackers to authenticat… | |
CVE-2026-19870 | | 2026-08-14 | Authorization Bypass Through User-Controlled Key in the payroll module in Roskus Prospero Flow CRM before 5.15.10 allows authenticated users holding the read p… | |
CVE-2026-19734 | | 2026-08-13 | Missing Authorization and Authorization Bypass Through User-Controlled Key in the product management component in Roskus Prospero Flow CRM before 5.4.7 allows… | |
CVE-2026-19539 | | 2026-08-11 | Authorization Bypass Through User-Controlled Key in the ticket management component in Roskus Prospero Flow CRM before 5.4.9 allows authenticated users of any… | |
CVE-2026-19433 | | 2026-08-10 | Authorization Bypass Through User-Controlled Key in the contact management component in Roskus Prospero Flow CRM before 5.4.8 allows authenticated users of any… | |
CVE-2026-59233 | | 2026-08-10 | Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, includin… | |
CVE-2026-59232 | | 2026-07-31 | Cross-site Scripting in the lead index view in Roskus Prospero Flow CRM before 5.3.7 allows authenticated users holding the create or update lead permission to… | |
CVE-2026-59240 | | 2026-07-27 | The vulnerability involves an Insecure Direct Object Reference (IDOR) in the `DeleteNotificationController::delete()` method at endpoint `GET /notification/del… | |
CVE-2026-59239 | | 2026-07-27 | Stored Cross-site Scripting (CWE-79) in the email module in Roskus Prospero Flow CRM before 5.4.4 allows a remote, authenticated low-privileged user to execute… | |
CVE-2026-59237 | | 2026-07-16 | Authorization Bypass Through User-Controlled Key (CWE-639) in the Order and OrderItem REST API controllers in Roskus Prospero Flow CRM before 5.5.3 allows a re… | |
CVE-2026-59236 | | 2026-07-15 | Authorization Bypass Through User-Controlled Key (CWE-639) in the Excel import handlers (CustomerImport, LeadImport, ProductImport) in Roskus Prospero Flow CRM… | |
CVE-2026-59235 | | 2026-07-15 | Missing Authorization (CWE-862) in BankAccountListController (app/Http/Controllers/Api/BankAccount/BankAccountListController.php), exposed at GET /api/bank-acc… | |
CVE-2026-59234 | | 2026-07-03 | Authorization Bypass Through User-Controlled Key (CWE-639) in CalendarDeleteEventController (app/Http/Controllers/Calendar/CalendarDeleteEventController.php)… |