Advisories · Technology
Roskus Prospero Flow CRM.
Every CVE that names Roskus Prospero Flow CRM among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.6 High
Missing authorization in the Prospero Flow CRM user API allows a basic role user to read and delete other accounts
- Roskus Prospero Flow CRM
- Broken access control
- CVSS 5.1 Medium
CSRF in Prospero Flow CRM order confirmation allows unauthorized order state changes
- Roskus Prospero Flow CRM
- Cross-site request forgery (CSRF)
- CVSS 4.8 Medium
Unrestricted upload of file with dangerous type in Prospero Flow CRM product photo allows stored cross-site scripting
- Roskus Prospero Flow CRM
- Unrestricted file upload
- CVSS 9.3 CriticalCritical · CVSS 9+
IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification
- Roskus Prospero Flow CRM
- Broken access control
- CVSS 4.8 Medium
Unrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVG
- Roskus Prospero Flow CRM
- Unrestricted file upload
- CVSS 5.3 Medium
Unvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save endpoint allow cross-tenant disclosure of banking identifiers
- Roskus Prospero Flow CRM
- Broken access control
- CVSS 8.7 High
IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records
- Roskus Prospero Flow CRM
- Broken access control
- CVSS 9.3 CriticalCritical · CVSS 9+
Use of hard-coded credentials in Prospero Flow CRM employee onboarding
- Roskus Prospero Flow CRM
- Hard-coded credentials
- CVSS 8.6 High
IDOR in Prospero Flow CRM allows cross-tenant payroll disclosure and creation
- Roskus Prospero Flow CRM
- Broken access control
- CVSS 8.6 High
IDOR in Prospero Flow CRM allows cross-tenant product disclosure and hijacking
- Roskus Prospero Flow CRM
- Broken access control
- CVSS 8.6 High
IDOR in Prospero Flow CRM allows cross-tenant ticket read, hijacking, and deletion
- Roskus Prospero Flow CRM
- Broken access control
- CVSS 8.6 High
Authorization Bypass Through User-Controlled Key in Prospero Flow CRM contact save and vCard export
- Roskus Prospero Flow CRM
- Broken access control
- CVSS 8.7 High
Missing Authorization in Prospero Flow CRM permission save endpoint allows privilege escalation
- Roskus Prospero Flow CRM
- Broken access control
- CVSS 5.3 Medium
Stored Cross-site Scripting in Prospero Flow CRM lead name field
- Roskus Prospero Flow CRM
- Cross-site scripting (XSS)
- CVSS 6.9 Medium
IDOR in Prospero Flow CRM allows deletion of other users' notifications
- Roskus Prospero Flow CRM
- Broken access control
- CVSS 8.6 High
Stored XSS in Prospero Flow CRM email body allows administrator account takeover
- Roskus Prospero Flow CRM
- Cross-site scripting (XSS)
- CVSS 6.9 Medium
IDOR in Prospero Flow CRM Order API allows cross-tenant read and modification of orders
- Roskus Prospero Flow CRM
- Broken access control
- CVSS 6.9 Medium
Authorization bypass in Prospero Flow CRM Excel import allows cross-tenant record injection
- Roskus Prospero Flow CRM
- Broken access control
- CVSS 8.7 High
Missing authorization in Prospero Flow CRM allows low-privileged users to read all bank accounts
- Roskus Prospero Flow CRM
- Broken access control
- CVSS 6.9 Medium
Authorization Bypass Through User-Controlled Key in Prospero Flow CRM calendar event deletion
- Roskus Prospero Flow CRM
- Broken access control