CVE-2026-59232

5.3 Moyenne

Publiée le 31/07/2026 à 18:17 · Modifiée le 01/09/2026 à 22:52 · Analyse NVD reportée · Source : 4daa8cea-433a-44bd-9456-53b127fc289a

Description

Cross-site Scripting in the lead index view in Roskus Prospero Flow CRM before 5.3.7 allows authenticated users holding the create or update lead permission to execute arbitrary JavaScript in the application origin via HTML markup stored in the lead name field, which the view renders through Blade's unescaped output directive and inside a JavaScript string literal in an onclick attribute.

Traduire en français

Produits concernés

Roskus Prospero Flow CRM

Scores CVSS

Version	Score	Source	Vecteur
4.0	5.3 Moyenne	4daa8cea-433a-44bd-9456-53b127fc289a	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`

Faiblesses (CWE)

CWE-79

Références

https://github.com/Roskus/prospero-flow-crm/commit/8b2633ddb2178c2f79718efdfb906e051ba2f03c
https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3
https://secur0.com/en/cna/cve-list/cve-2026-59232-stored-xss-in-prospero-flow-crm-lead-name-field

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories