PF
Product
Prospero Flow CRM
20
CVEs
0
On KEV
9.3
Max CVSS
1
New 30D
Severity mix
Critical 2High 9Medium 9Low 0
Watch
Add Prospero Flow CRM to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-78365 | 9.3 | Aug 24 | IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification Affected: 4.0.0 before 5.3.2 |
| CVE-2026-19871 | 9.3 | Aug 14 | Use of hard-coded credentials in Prospero Flow CRM employee onboarding Affected: before 5.15.9 |
| CVE-2026-77759 | 8.7 | Aug 21 | IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records Affected: 5.0.0 before 5.3.6 |
| CVE-2026-59233 | 8.7 | Aug 10 | Missing Authorization in Prospero Flow CRM permission save endpoint allows privilege escalation Affected: before 5.2.1 |
| CVE-2026-59235 | 8.7 | Jul 15 | Missing authorization in Prospero Flow CRM allows low-privileged users to read all bank accounts Affected: 4.6.0 before 5.5.3 |
| CVE-2026-114519 New | 8.6 | Oct 22 | Missing authorization in the Prospero Flow CRM user API allows a basic role user to read and delete other accounts Affected: 2.0.0 before 5.26.0 |
| CVE-2026-19870 | 8.6 | Aug 14 | IDOR in Prospero Flow CRM allows cross-tenant payroll disclosure and creation Affected: before 5.15.10 |
| CVE-2026-19734 | 8.6 | Aug 13 | IDOR in Prospero Flow CRM allows cross-tenant product disclosure and hijacking Affected: before 5.4.7 |
| CVE-2026-19539 | 8.6 | Aug 11 | IDOR in Prospero Flow CRM allows cross-tenant ticket read, hijacking, and deletion Affected: before 5.4.9 |
| CVE-2026-19433 | 8.6 | Aug 10 | Authorization Bypass Through User-Controlled Key in Prospero Flow CRM contact save and vCard export Affected: before 5.4.8 |
| CVE-2026-59239 | 8.6 | Jul 27 | Stored XSS in Prospero Flow CRM email body allows administrator account takeover Affected: 1.0.0 before 5.4.4 |
| CVE-2026-59240 | 6.9 | Jul 27 | IDOR in Prospero Flow CRM allows deletion of other users' notifications Affected: 1.0.0 before 5.5.1 |
| CVE-2026-59237 | 6.9 | Jul 16 | IDOR in Prospero Flow CRM Order API allows cross-tenant read and modification of orders Affected: 4.6.0 before 5.5.3 |
| CVE-2026-59236 | 6.9 | Jul 15 | Authorization bypass in Prospero Flow CRM Excel import allows cross-tenant record injection Affected: 1.0.0 before 5.14.0 |
| CVE-2026-59234 | 6.9 | Jul 3 | Authorization Bypass Through User-Controlled Key in Prospero Flow CRM calendar event deletion Affected: 1.0.0 before 5.5.3 |
| CVE-2026-77780 | 5.3 | Aug 21 | Unvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save endpoint allow cross-tenant disclosure of banking identifiers Affected: 4.9.1 before 5.14.2 |
| CVE-2026-59232 | 5.3 | Jul 31 | Stored Cross-site Scripting in Prospero Flow CRM lead name field Affected: before 5.3.7 |
| CVE-2026-82911 | 5.1 | Sep 4 | CSRF in Prospero Flow CRM order confirmation allows unauthorized order state changes Affected: before 5.15.11 |
| CVE-2026-81931 | 4.8 | Aug 27 | Unrestricted upload of file with dangerous type in Prospero Flow CRM product photo allows stored cross-site scripting Affected: before 5.16.0 |
| CVE-2026-78337 | 4.8 | Aug 24 | Unrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVG Affected: before 5.15.13 |
Showing 20