RO
Vendor
Roskus
20
CVEs
0
On KEV
1
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-114519 New | PF Prospero Flow CRM Roskus | 8.6 | Oct 22 | Missing authorization in the Prospero Flow CRM user API allows a basic role user to read and delete other accounts |
| CVE-2026-82911 | PF Prospero Flow CRM Roskus | 5.1 | Sep 4 | CSRF in Prospero Flow CRM order confirmation allows unauthorized order state changes |
| CVE-2026-81931 | PF Prospero Flow CRM Roskus | 4.8 | Aug 27 | Unrestricted upload of file with dangerous type in Prospero Flow CRM product photo allows stored cross-site scripting |
| CVE-2026-78365 | PF Prospero Flow CRM Roskus | 9.3 | Aug 24 | IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification |
| CVE-2026-78337 | PF Prospero Flow CRM Roskus | 4.8 | Aug 24 | Unrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVG |
| CVE-2026-77780 | PF Prospero Flow CRM Roskus | 5.3 | Aug 21 | Unvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save endpoint allow cross-tenant disclosure of banking identifiers |
| CVE-2026-77759 | PF Prospero Flow CRM Roskus | 8.7 | Aug 21 | IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records |
| CVE-2026-19871 | PF Prospero Flow CRM Roskus | 9.3 | Aug 14 | Use of hard-coded credentials in Prospero Flow CRM employee onboarding |
| CVE-2026-19870 | PF Prospero Flow CRM Roskus | 8.6 | Aug 14 | IDOR in Prospero Flow CRM allows cross-tenant payroll disclosure and creation |
| CVE-2026-19734 | PF Prospero Flow CRM Roskus | 8.6 | Aug 13 | IDOR in Prospero Flow CRM allows cross-tenant product disclosure and hijacking |
| CVE-2026-19539 | PF Prospero Flow CRM Roskus | 8.6 | Aug 11 | IDOR in Prospero Flow CRM allows cross-tenant ticket read, hijacking, and deletion |
| CVE-2026-19433 | PF Prospero Flow CRM Roskus | 8.6 | Aug 10 | Authorization Bypass Through User-Controlled Key in Prospero Flow CRM contact save and vCard export |
| CVE-2026-59233 | PF Prospero Flow CRM Roskus | 8.7 | Aug 10 | Missing Authorization in Prospero Flow CRM permission save endpoint allows privilege escalation |
| CVE-2026-59232 | PF Prospero Flow CRM Roskus | 5.3 | Jul 31 | Stored Cross-site Scripting in Prospero Flow CRM lead name field |
| CVE-2026-59240 | PF Prospero Flow CRM Roskus | 6.9 | Jul 27 | IDOR in Prospero Flow CRM allows deletion of other users' notifications |
| CVE-2026-59239 | PF Prospero Flow CRM Roskus | 8.6 | Jul 27 | Stored XSS in Prospero Flow CRM email body allows administrator account takeover |
| CVE-2026-59237 | PF Prospero Flow CRM Roskus | 6.9 | Jul 16 | IDOR in Prospero Flow CRM Order API allows cross-tenant read and modification of orders |
| CVE-2026-59236 | PF Prospero Flow CRM Roskus | 6.9 | Jul 15 | Authorization bypass in Prospero Flow CRM Excel import allows cross-tenant record injection |
| CVE-2026-59235 | PF Prospero Flow CRM Roskus | 8.7 | Jul 15 | Missing authorization in Prospero Flow CRM allows low-privileged users to read all bank accounts |
| CVE-2026-59234 | PF Prospero Flow CRM Roskus | 6.9 | Jul 3 | Authorization Bypass Through User-Controlled Key in Prospero Flow CRM calendar event deletion |