Medium severity · published Jul 31, 2026
CVE-2026-59232
Stored Cross-site Scripting in Prospero Flow CRM lead name field
5.3
CVSS
0.5%
EPSS
No
On KEV
Description
Cross-site Scripting in the lead index view in Roskus Prospero Flow CRM before 5.3.7 allows authenticated users holding the create or update lead permission to execute arbitrary JavaScript in the application origin via HTML markup stored in the lead name field, which the view renders through Blade's unescaped output directive and inside a JavaScript string literal in an onclick attribute.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PF
Prospero Flow CRM · Roskus
before 5.3.7 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-59232
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-59232
github.com
https://github.com/Roskus/prospero-flow-crm/commit/8b2633ddb2178c2f79718efdfb906e051ba2f03c
github.com
https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3
secur0.com
https://secur0.com/en/cna/cve-list/cve-2026-59232-stored-xss-in-prospero-flow-crm-lead-name-field
More from Prospero Flow CRM
9.3
CVE-2026-78365
IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification
9.3
CVE-2026-19871
Use of hard-coded credentials in Prospero Flow CRM employee onboarding
8.7
CVE-2026-77759
IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records
8.7
CVE-2026-59233
Missing Authorization in Prospero Flow CRM permission save endpoint allows privilege escalation
8.7
CVE-2026-59235
Missing authorization in Prospero Flow CRM allows low-privileged users to read all bank accounts